CVE-2024-28584

Executive Summary

CVE-2024-28584 is a Null Pointer Dereference vulnerability in the open source FreeImage library version 3.19.0 [r1909]. The flaw resides in the J2KImageToFIBITMAP() function, which is invoked when processing images in the J2K (JPEG 2000) format. A local attacker can trigger a denial of service (DoS) by providing a specially crafted J2K image file, causing the application to crash due to dereferencing a null pointer. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the local attack vector and requirement for user interaction. No public exploit code or patch is currently available.

Supply Chain & Package Security

FreeImage is a widely used open-source image library integrated into numerous applications, including scientific imaging software, game engines, and multimedia tools. As a C/C++ library, it is distributed as source code and precompiled binaries. The vulnerability affects any software that links against the vulnerable version of FreeImage and processes J2K images. Supply chain risk is elevated because the vendor has not released a patch, and the library is often statically linked, making it difficult for downstream projects to update independently.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to trick a user into opening a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond providing a crafted file.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The application crashes, causing a denial of service.

Threat Level: Medium. Exploitation requires user interaction, but the impact is a complete denial of service. The lack of a patch increases the risk for unmaintained systems.

Deep Dive & Mechanics

The vulnerability is a classic null pointer dereference in the J2KImageToFIBITMAP() function within FreeImage's JPEG 2000 decoder. When parsing a malformed J2K file, the function fails to properly validate a pointer before dereferencing it. Specifically, during the conversion of JPEG 2000 codestream data to FreeImage's internal bitmap format, a pointer to a memory structure (likely a tile or component buffer) is not checked for NULL after a failed allocation or parsing step. The code then attempts to write to or read from this NULL pointer, causing a segmentation fault.

The root cause is insufficient input validation and error handling in the J2K decoder. The function assumes that certain internal structures are always valid after parsing, but a crafted file can cause an early exit or allocation failure, leaving the pointer uninitialized or set to NULL.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common null pointer dereference remediation.

Vulnerable Code (FreeImage 3.19.0, Source/FreeImage/PluginJ2K.cpp):

FIBITMAP *J2KImageToFIBITMAP(opj_image_t *image) {
    // ... parsing and allocation ...
    opj_image_comp_t *comp = &image->comps[0]; // Assume comps[0] exists
    // No check if comp is NULL or if image->comps is empty
    // Directly dereference comp
    unsigned int width = comp->w;
    unsigned int height = comp->h;
    // ... further processing ...
}

Patched Code (Hypothetical):

FIBITMAP *J2KImageToFIBITMAP(opj_image_t *image) {
    if (!image || !image->comps || image->numcomps == 0) {
        return NULL; // Early exit on invalid input
    }
    opj_image_comp_t *comp = &image->comps[0];
    if (!comp) {
        return NULL; // Null check after pointer retrieval
    }
    unsigned int width = comp->w;
    unsigned int height = comp->h;
    // ... further processing ...
}

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service on a target application using FreeImage.

Prerequisites:

• A target application that uses FreeImage 3.19.0 [r1909] and processes J2K files.
• Ability to deliver a malicious J2K file (e.g., via email, web upload, or local access).

Steps:

1. Craft the Malicious J2K File:

   • Use a hex editor or a fuzzing tool to modify a valid J2K file. The goal is to cause a null pointer dereference in J2KImageToFIBITMAP(). For example, corrupt the SIZ marker segment to set the number of components to 0, or corrupt the tile-part header to cause an allocation failure.
   • A simple approach: take a valid .j2k file, open it in a hex editor, and zero out the bytes that define the number of components (e.g., at offset 0x2C for a typical file). This may cause the decoder to skip component allocation, leaving the pointer NULL.

2. Deliver the File:

   • Send the file to the target user via phishing email, or upload it to a web application that processes images.

3. Trigger the Vulnerability:

   • The user opens the file with the vulnerable application. The application crashes immediately, causing a denial of service.

Example (Conceptual):

# Using a hex editor to corrupt a J2K file
# Original file: valid.j2k
# Corrupted file: exploit.j2k
# Modify byte at offset 0x2C from 0x03 to 0x00 (set components to 0)
# Then deliver exploit.j2k to the target

Blue Team

Detection:

• Monitor for application crashes (segmentation faults) in logs.
• Use file integrity monitoring to detect the presence of malformed J2K files.
• Deploy endpoint detection and response (EDR) solutions that can detect null pointer dereference patterns.

Mitigation:

• If possible, disable J2K support in applications using FreeImage.
• Apply a workaround by patching the FreeImage source code (as shown in the patched code section) and recompiling.
• Use a web application firewall (WAF) to block uploads of malformed J2K files (though this is difficult without deep packet inspection).

Indicators of Compromise (IOCs)

• File Hashes (Example):
  • malicious.j2k: SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder)
• Behavioral:
  • Application crash logs containing SIGSEGV or NULL pointer dereference in the context of J2KImageToFIBITMAP.
  • Unexpected termination of processes that use FreeImage.
• Network:
  • No network indicators; the attack is local file-based.

Detection Engineering

YARA Rule

rule CVE_2024_28584_J2K_Null_Pointer {
    meta:
        description = "Detects malformed J2K files that may trigger CVE-2024-28584"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28584"
    strings:
        $j2k_magic = { FF 4F FF 51 }  // J2K SOC and SIZ markers
        $zero_components = { 00 00 }  // Potential zero component count
    condition:
        $j2k_magic at 0 and $zero_components at 0x2C
}

Sigma Rule

title: CVE-2024-28584 FreeImage J2K Null Pointer Dereference
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects application crashes caused by CVE-2024-28584
author: Valters IT
logsource:
    category: application
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: 'Application Error'
        Data: '*J2KImageToFIBITMAP*'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28584 J2K File Transfer Detected"; flow:to_server; fileext:"j2k"; content:"|FF 4F FF 51|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable J2K Support: If possible, configure applications to not process J2K files. This is the most effective workaround.
2. Patch the Source Code: Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section to the FreeImage source and recompile.
3. Use a Different Library: Migrate to an alternative image library that is actively maintained, such as libvips or ImageMagick (with proper security configurations).

Long-Term Actions:

• Monitor the FreeImage project for an official patch.
• Implement input validation and fuzzing in your own applications that use FreeImage.
• Consider using a sandbox or containerization to isolate image processing tasks.

Valters IT Signature

This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal. Always follow responsible disclosure practices.