CVE-2024-41311
📋 TL;DR
CVE-2024-41311 is an out-of-bounds read/write vulnerability in Libheif's ImageOverlay::parse() function when processing malicious HEIF files with forged offsets. This allows attackers to potentially execute arbitrary code or cause denial of service. Anyone using Libheif to process HEIF images is affected.
💻 Affected Systems
- Libheif
- Applications using Libheif library
📦 What is this software?
Libheif by Struktur
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Application crash (denial of service) or information disclosure
If Mitigated
Application crash with limited impact if sandboxed
🎯 Exploit Status
Proof of concept available in GitHub gist, exploitation requires user to process malicious HEIF file
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Libheif 1.17.7 and later
Vendor Advisory: https://github.com/strukturag/libheif/commit/a3ed1b1eb178c5d651d6ac619c8da3d71ac2be36
Restart Required: No
Instructions:
1. Update Libheif to version 1.17.7 or later. 2. Recompile any applications using Libheif. 3. Restart affected services if they were running with vulnerable version.
🔧 Temporary Workarounds
Disable HEIF processing
allTemporarily disable HEIF file processing in applications
Input validation
allImplement strict file type validation before processing
🧯 If You Can't Patch
- Implement strict file upload restrictions for HEIF files
- Run applications in sandboxed/containerized environments
🔍 How to Verify
Check if Vulnerable:
Check Libheif version with: libheif --version or dpkg -l | grep libheifCheck Version:
libheif --versionVerify Fix Applied:
Verify version is 1.17.7 or higher: libheif --version | grep -q '1\.1[7-9]\.[7-9]'📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing HEIF files
- Memory access violation errors
Network Indicators:
- Unusual HEIF file uploads to web services
SIEM Query:
source="application.log" AND ("segmentation fault" OR "access violation") AND "heif"🔗 References
- https://gist.github.com/flyyee/79f1b224069842ee320115cafa5c35c0
- https://github.com/strukturag/libheif/commit/a3ed1b1eb178c5d651d6ac619c8da3d71ac2be36
- https://github.com/strukturag/libheif/issues/1226
- https://github.com/strukturag/libheif/pull/1227
- https://lists.debian.org/debian-lts-announce/2024/10/msg00025.html
