CVE-2023-6277: Libtiff Out-of-Memory DoS Vulnerability

CVE-2023-6277 Overview

CVE-2023-6277 is an out-of-memory flaw in libtiff, the widely deployed library for reading and writing Tagged Image File Format (TIFF) files. A remote attacker can pass a crafted TIFF file to the TIFFOpen() API and trigger excessive memory allocation, causing a denial of service. The malicious input can be smaller than 379 KB, making the condition easy to weaponize through common file delivery channels such as email attachments, web uploads, and document processing pipelines. The flaw is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
A small, malformed TIFF file passed to TIFFOpen() can exhaust process memory and crash any application or service that parses TIFF images using vulnerable libtiff versions.

Affected Products

libtiff (upstream library)
Red Hat Enterprise Linux 6, 7, 8, and 9
Fedora 38

Discovery Timeline

2023-11-24 - CVE-2023-6277 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-6277

Vulnerability Analysis

The defect lives in libtiff's file-opening path. When TIFFOpen() parses a crafted TIFF header, the library computes allocation sizes from attacker-controlled directory fields without sufficiently constraining them against the actual file size. The result is an oversized memory request that the host cannot satisfy, terminating the calling process.

Because TIFF parsing happens inside many image viewers, thumbnail generators, document converters, printer drivers, and server-side imaging pipelines, the attack surface is broad. The flaw affects confidentiality and integrity minimally but produces a high availability impact: any service that auto-processes user-supplied TIFF data can be crashed repeatedly. See the Red Hat CVE-2023-6277 Advisory and the GitLab libtiff Issue #614 for upstream analysis.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400]. libtiff derives buffer sizes from TIFF directory metadata before validating them against the file's true bounds. A crafted file declares large strip, tile, or directory counts, prompting libtiff to request memory far exceeding the file payload.

Attack Vector

The attack vector is network-reachable but requires user interaction: a victim or automated service must open the malicious TIFF. Typical delivery paths include web uploads to image-processing endpoints, email attachments rendered by mail clients, and document conversion services that call libtiff internally.

No public exploit code or proof-of-concept is listed in the GitLab libtiff Merge Request #545 discussion, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities list. Technical details of the crafted-file structure are documented in the upstream issue tracker.

Detection Methods for CVE-2023-6277

Indicators of Compromise

Unexpected process termination or out-of-memory (OOM) killer events for applications that handle TIFF files, such as convert, gs, tiffinfo, or web-server worker processes
Repeated upload attempts of small TIFF files (under 400 KB) followed by service crashes or 5xx errors
Sudden spikes in resident memory usage by image-processing daemons immediately after a file is parsed

Detection Strategies

Inventory installed libtiff package versions across Linux fleets using package managers (rpm -q libtiff, dpkg -l libtiff*) and compare against patched releases listed in vendor advisories
Inspect application logs from image-processing services for TIFFOpen errors, malloc failures, or glibc abort messages correlated with user-supplied files
Use file-upload gateways to scan TIFF headers for anomalous strip and tile counts that imply oversized allocations

Monitoring Recommendations

Alert on kernel OOM-killer entries (/var/log/messages, journalctl -k) targeting image-handling processes
Track crash and restart counts for services that ingest user-supplied images, including web upload handlers and document converters
Monitor cgroup memory limits for containers running TIFF-processing workloads to catch repeated allocation failures

How to Mitigate CVE-2023-6277

Immediate Actions Required

Update libtiff to the patched version supplied by your distribution; Red Hat, Fedora, NetApp, and Apple have all shipped fixes referenced in the vendor advisories
Restart all long-running services that link against libtiff so they load the patched library into memory
Restrict upload size limits and apply per-process memory cgroup limits on services that parse user-supplied TIFF files

Patch Information

The upstream fix is tracked in GitLab libtiff Merge Request #545 and validates allocation sizes against actual file dimensions before calling malloc. Distribution-specific updates are available through the Red Hat CVE-2023-6277 Advisory, the Fedora Package Announcement, the NetApp Security Advisory ntap-20240119-0002, and Apple's macOS and iOS updates documented in Apple Support Document HT214116.

Workarounds

Disable automatic TIFF rendering in mail clients and document pipelines where the format is not required
Sandbox TIFF processing under strict memory limits (systemdMemoryMax, container --memory flags, or ulimit -v) so crashes do not affect parent services
Reject TIFF uploads at application gateways until patched binaries are deployed across the environment

bash

# Configuration example
# Verify and update libtiff on Red Hat / Fedora systems
rpm -q libtiff
sudo dnf update libtiff

# Enforce a memory ceiling on a TIFF-processing systemd service
sudo systemctl set-property image-worker.service MemoryMax=512M

# Confirm services have reloaded the patched library
sudo lsof +c 0 | grep libtiff