CVE-2022-4981

Executive Summary

CVE-2022-4981 is a locally exploitable null pointer dereference vulnerability in DCMTK up to version 3.6.7. The flaw resides in the DcmQueryRetrieveConfig::readPeerList function within the dcmqrscp component, specifically in the file /dcmqrcnf.cc. Successful exploitation leads to a denial of service (DoS) condition via application crash. The attack vector is local, requiring the attacker to have access to the system running the vulnerable service. A public exploit is available, and the vendor has released a fix in version 3.6.8.

Supply Chain & Package Security

This vulnerability affects the DCMTK library, which is a widely used open-source toolkit for DICOM (Digital Imaging and Communications in Medicine) medical imaging. Organizations using DCMTK in their software supply chain should verify they are not bundling a vulnerable version (≤ 3.6.7). The fix is available in version 3.6.8, and the patch commit is 957fb31e5.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The low CVSS score reflects the local attack vector and limited impact (availability only). However, in medical environments where DCMTK is used for critical imaging workflows, a DoS could disrupt operations.

Deep Dive & Mechanics

The vulnerability is a null pointer dereference in the DcmQueryRetrieveConfig::readPeerList function. This function is responsible for parsing a peer list configuration file used by the dcmqrscp DICOM query/retrieve service provider. When the function encounters malformed or unexpected input during the parsing process, it attempts to dereference a pointer that has not been properly initialized or has been set to NULL. This results in a segmentation fault, crashing the application.

The root cause is insufficient input validation. The function does not check for NULL pointers before using them, allowing an attacker to craft a configuration file that triggers the dereference. Since the attack is local, the attacker must have the ability to write or modify the configuration file read by dcmqrscp.

Vulnerable vs. Patched Code

Vulnerable Code (≤ 3.6.7): The vulnerable code in /dcmqrcnf.cc does not validate the return value of a function that returns a pointer. If the function returns NULL, the subsequent dereference causes a crash.

// Vulnerable snippet (conceptual)
OFCondition DcmQueryRetrieveConfig::readPeerList(const char *fname)
{
    // ... parsing logic ...
    DcmPeerEntry *peer = getNextPeer(); // may return NULL
    // No NULL check before dereference
    peer->someMethod(); // NULL pointer dereference
    // ...
}

Patched Code (3.6.8 / commit 957fb31e5): The patch adds a NULL check before dereferencing the pointer, preventing the crash.

// Patched snippet (conceptual)
OFCondition DcmQueryRetrieveConfig::readPeerList(const char *fname)
{
    // ... parsing logic ...
    DcmPeerEntry *peer = getNextPeer();
    if (peer == NULL) {
        // Handle error gracefully
        return EC_IllegalCall;
    }
    peer->someMethod(); // Safe dereference
    // ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the system running dcmqrscp with DCMTK ≤ 3.6.7.
• Ability to write to the configuration file (e.g., /etc/dcmtk/dcmqrscp.cfg).

Exploitation Steps:

1. Identify the configuration file used by dcmqrscp.
2. Craft a malicious configuration file that triggers the null pointer dereference. For example, provide an empty or malformed peer list entry.
3. Replace the legitimate configuration file with the malicious one.
4. Restart the dcmqrscp service or wait for it to re-read the configuration.
5. The service will crash upon parsing the malicious file, resulting in a denial of service.

Example Malicious Configuration (conceptual):

# Malicious peer list entry
Peer: 

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes of the dcmqrscp process.
• Monitor for unauthorized modifications to DCMTK configuration files.
• Use file integrity monitoring (FIM) to detect changes to /etc/dcmtk/dcmqrscp.cfg or similar.

Mitigation:

• Upgrade DCMTK to version 3.6.8 or apply the patch.
• Restrict write access to DCMTK configuration files to only authorized users.
• Implement application whitelisting to prevent unauthorized binaries from running.

Indicators of Compromise (IOCs)

• File: /etc/dcmtk/dcmqrscp.cfg (or similar) – unexpected modifications.
• Process: dcmqrscp – frequent crashes or segmentation faults.
• Logs: System logs showing dcmqrscp crashing with signal SIGSEGV.
• Network: No network-based IOCs as the attack is local.

Detection Engineering

YARA Rule

rule CVE_2022_4981_DCMTK_Null_Pointer_Dereference {
    meta:
        description = "Detects DCMTK binaries vulnerable to CVE-2022-4981"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-4981"
    strings:
        $vuln_func = "DcmQueryRetrieveConfig::readPeerList"
        $null_check = { 48 85 C0 74 ?? } // test rax, rax; je <offset>
    condition:
        $vuln_func and not $null_check
}

Sigma Rule

title: DCMTK dcmqrscp Crash Detection
id: 7a8b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects crashes of the dcmqrscp process, potentially indicating exploitation of CVE-2022-4981
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/dcmqrscp'
        ExitCode: -11  # SIGSEGV
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2022-4981 DCMTK dcmqrscp Local Exploit Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; reference:cve,2022-4981; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder as the attack is local and may not generate network traffic. Adjust based on actual attack vector.

Remediation & Mitigation

1. Immediate: Upgrade DCMTK to version 3.6.8 or apply commit 957fb31e5.
2. Short-term: Restrict write access to DCMTK configuration files to only authorized administrators.
3. Long-term: Implement file integrity monitoring (FIM) for critical configuration files. Regularly update all software components in the medical imaging pipeline.
4. Compensating Controls: If upgrade is not immediately possible, monitor for crashes of dcmqrscp and investigate any anomalies.

Valters IT
DevSecOps & Cyber Threat Intelligence