CVE-2021-45481

What it actually does

Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create causes a segmentation violation that crashes the WebKitGTK process, resulting in denial of service with no impact on confidentiality or integrity.

Why it matters to the business

Applications relying on WebKitGTK for web content rendering can be forced offline by remote attackers, disrupting user workflows and requiring restarts; the issue remains exploitable years after disclosure with public exploit code available and mentions in ransomware campaigns.

How an attack unfolds

An attacker crafts a malicious web page or image resource that triggers the flawed allocation path in ImageBufferCairoImageSurfaceBackend; when a victim application loads the content, the resulting segfault crashes the process. Public exploits exist and the vulnerability has been referenced in campaigns including Interlock ransomware activity.

How to fix it

Upgrade WebKitGTK to version 2.32.4 or later; where immediate patching is not feasible, isolate affected applications or disable web content rendering features that exercise the Cairo backend.

How to confirm the fix worked

Verify the installed WebKitGTK package version is at least 2.32.4; test rendering of known trigger resources in a controlled environment to confirm absence of crashes.

Typical attack path

1. Attacker hosts or embeds a specially crafted image or web resource targeting the Cairo image surface backend
2. Victim application using vulnerable WebKitGTK fetches or renders the resource
3. Incorrect allocation in create() leads to invalid memory access and immediate segmentation fault
4. Application terminates, achieving denial of service

How to detect it

Review application and system logs for repeated WebKitGTK process crashes correlated with web content loading; look for segmentation fault entries in crash reports or syslog around the time of suspected incidents.

What your security team should do

• Prioritize updating all WebKitGTK instances to 2.32.4 or newer across the environment
• Monitor upstream WebKitGTK release notes for any additional hardening changes
• Review application dependencies to identify downstream consumers of the affected library
• Apply network-level controls to limit exposure of affected renderers to untrusted content where updates are delayed