CVE-2024-28563

Executive Summary

CVE-2024-28563 identifies a buffer overflow vulnerability in the open-source FreeImage library, version 3.19.0 (r1909). The flaw resides in the Imf_2_2::DwaCompressor::Classifier::Classifier() function, which is invoked when processing EXR (OpenEXR) format images. A local attacker can exploit this vulnerability to cause a denial of service (DoS) by providing a specially crafted EXR file that triggers an out-of-bounds write. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for systems that process untrusted EXR images.

Supply Chain & Package Security

FreeImage is a widely used open-source library for image format support, integrated into numerous applications and services. This vulnerability affects the library's supply chain, as any software that statically or dynamically links FreeImage version 3.19.0 (r1909) is potentially vulnerable. Users and developers should monitor for patches from the FreeImage project and consider alternative image processing libraries if immediate remediation is not possible.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No privileges needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must open the malicious EXR file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Estimated Base Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires local access and user interaction, but it can lead to a denial of service, potentially impacting availability.

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow in the Imf_2_2::DwaCompressor::Classifier::Classifier() function within FreeImage's EXR handling code. The EXR format, developed by Industrial Light & Magic, supports high dynamic range images and uses compression schemes like DwaCompressor. The Classifier constructor is part of the DwaCompressor's classification logic, which categorizes image data for compression.

The flaw occurs when the function copies data into a fixed-size buffer without proper bounds checking. By crafting an EXR file with maliciously crafted metadata or compressed data, an attacker can cause the function to write beyond the allocated buffer, corrupting adjacent memory. This corruption can lead to a crash (denial of service) or potentially be leveraged for arbitrary code execution if the attacker can control the overflow data.

The vulnerable code path is triggered when FreeImage reads an EXR file and invokes the DwaCompressor's classification routine. The exact buffer size and overflow mechanism are not publicly documented, but the vulnerability is confirmed by the CVE entry.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be provided. However, the vulnerable code likely resembles:

// Vulnerable code (conceptual)
void Classifier::Classifier(const char* input, size_t inputSize) {
    char buffer[256];
    // No bounds check
    memcpy(buffer, input, inputSize); // Overflow if inputSize > 256
}

A patched version would include bounds checking:

// Patched code (conceptual)
void Classifier::Classifier(const char* input, size_t inputSize) {
    char buffer[256];
    if (inputSize > sizeof(buffer)) {
        // Handle error or truncate
        return;
    }
    memcpy(buffer, input, inputSize);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• FreeImage version 3.19.0 (r1909) installed on a test system.
• A tool to craft malicious EXR files (e.g., Python with struct module).

Steps:

1. Craft a Malicious EXR File: Create an EXR file with oversized data in the DwaCompressor classification section. The exact offset and size depend on the vulnerable function's buffer.
2. Deliver the File: Use social engineering or local access to place the file on the target system.
3. Trigger the Vulnerability: Open the file with an application that uses FreeImage (e.g., an image viewer or converter). The application will crash due to the buffer overflow.

Example Python Script (Conceptual):

import struct

# Craft a malicious EXR file (simplified)
def create_malicious_exr(filename):
    # EXR header (magic number, version, etc.)
    header = b'\x76\x2f\x31\x01'  # Magic number and version
    # ... (other EXR structures)
    # Overflow payload
    payload = b'A' * 1000  # Oversized data
    with open(filename, 'wb') as f:
        f.write(header)
        f.write(payload)

create_malicious_exr('exploit.exr')

Note: No public exploit exists; this is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for crashes in applications using FreeImage when processing EXR files.
• Use file integrity monitoring to detect unexpected EXR files.
• Implement behavioral analysis to detect abnormal memory access patterns.

Prevention:

• Restrict execution of untrusted EXR files.
• Use sandboxing or containerization for applications that process images.
• Apply memory protection mechanisms (e.g., ASLR, DEP).

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• File Names: *.exr files with unusual sizes or metadata.
• Network Traffic: None (local vulnerability).
• System Logs: Application crash logs (e.g., Windows Event ID 1000, Linux core dumps).
• Memory Artifacts: Heap corruption or buffer overflow patterns in FreeImage's memory space.

Detection Engineering

YARA Rule

rule CVE_2024_28563_FreeImage_EXR_BOF {
    meta:
        description = "Detects malicious EXR files exploiting CVE-2024-28563"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28563"
    strings:
        $exr_magic = { 76 2F 31 01 }  // EXR magic number
        $overflow_pattern = /[A-Za-z0-9]{500,}/  // Large data block
    condition:
        $exr_magic at 0 and #overflow_pattern > 0
}

Sigma Rule

title: CVE-2024-28563 FreeImage EXR Buffer Overflow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects application crashes caused by CVE-2024-28563
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: '*FreeImage*'
        FaultingModuleName: '*FreeImage*'
    condition: selection
falsepositives:
    - Legitimate EXR files with large metadata
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28563 FreeImage EXR Buffer Overflow Attempt"; flow:to_server; content:"|76 2F 31 01|"; depth:4; content:"|41 41 41 41|"; distance:0; within:1000; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable EXR Support: If possible, disable EXR format support in applications using FreeImage until a patch is available.
2. Input Validation: Implement strict validation of EXR file sizes and metadata before processing.
3. Update FreeImage: Monitor the FreeImage project for patches and update to the latest version when available.

Long-Term Measures:

1. Code Audit: Conduct a security audit of FreeImage's EXR handling code.
2. Memory Safety: Use memory-safe languages or add bounds checking to critical functions.
3. Sandboxing: Run image processing in isolated environments with limited privileges.

Workarounds:

• Use alternative libraries like OpenEXR directly (if properly maintained).
• Convert EXR files to other formats using a secure converter before processing.

Valters IT
Securing Digital Frontiers