CVE-2017-9122

What it actually does

The quicktime_read_moov function enters an infinite loop when parsing a crafted MP4 file, resulting in sustained high CPU consumption and denial of service.

Why it matters to the business

Systems processing untrusted media files can become unresponsive or exhaust resources, disrupting services that depend on the affected library; the packages are widely used in container ecosystems, increasing exposure surface.

How an attack unfolds

An attacker crafts a malicious MP4 file that triggers the vulnerable moov parsing path and delivers it to any application using the affected libquicktime version; public exploits exist and can be adapted to target any reachable file-processing endpoint.

How to fix it

Upgrade kyverno (Chainguard) to 1.11.4-r8 or newer and kyverno (Wolfi) to 1.11.4-r8 or newer; rebuild and redeploy any containers that embed the vulnerable library; disable MP4/quicktime processing if the functionality is unnecessary.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed releases; run regression tests with known-bad MP4 samples to verify the loop condition no longer occurs; monitor CPU and process health under load after deployment.

Typical attack path

1. Identify an application or service that accepts or processes MP4 files via the vulnerable library
2. Generate or obtain a crafted MP4 that exercises the infinite-loop condition in quicktime_read_moov
3. Deliver the file through normal input channels (upload, download, API, etc.)
4. Observe sustained CPU usage and service degradation or crash

How to detect it

Search process and system logs for sustained high CPU usage by processes linked to the vulnerable library when handling MP4 files; correlate file-upload or media-processing events with subsequent resource-exhaustion alerts.

What your security team should do

• Prioritize patching the affected Kyverno packages in all environments within the next maintenance window
• Inventory all container images and build pipelines that pull in libquicktime and enforce version pinning
• Add file-type validation or sandboxing for any media-processing workloads until upgrades are complete
• Review logging and resource limits to limit blast radius of similar parsing issues