Attack Chain

1. Attacker crafts a malicious ICO file containing a small data_size and specific header parameters.
2. Attacker sends an HTTP request to an exposed imgproxy endpoint to process the malicious ICO.
3. imgproxy passes the request to the underlying vips library.
4. The vips_foreign_load_ico_header function allocates a small heap buffer based on the malicious data_size.
5. The loader performs OOB reads from the malformed header and performs OOB writes during BMP reconstruction.
6. The size field of the following heap chunk is corrupted during the OOB write.
7. The application invokes free() on the corrupted chunk.
8. The glibc allocator detects the corruption and triggers munmap_chunk(): invalid pointer, leading to worker termination.

Impact

Successful exploitation results in a persistent denial of service (DoS) for the specific worker process. Since a single request can trigger the abort, an attacker can crash workers at a rate proportional to the volume of requests sent to the vulnerable endpoint.

Recommendation

1. Upgrade to imgproxy version 4.0.17 or later to incorporate the patch for the ICO loader heap memory corruption.
2. Implement request size limits and file validation filters to block unknown or suspicious ICO files before they reach the processing layer.
3. Deploy monitoring for worker process exit codes; alert on high frequencies of exit code 2 in imgproxy worker pods.