CVE-2024-34508

Executive Summary

CVE-2024-34508 is a denial-of-service vulnerability in the dcmnet module of DCMTK, an open-source library for handling DICOM (Digital Imaging and Communications in Medicine) medical imaging data. The vulnerability manifests as a segmentation fault (NULL pointer dereference) when processing a malformed DIMSE (DICOM Message Service Element) message. An unauthenticated attacker can exploit this by sending a specially crafted DICOM network message to a vulnerable service, causing the application to crash. This can lead to service disruption in medical imaging environments, potentially impacting clinical workflows. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics (network-based, low complexity, no authentication, denial-of-service impact), a reasonable CVSS v3.1 vector would be: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Base Score: 7.5, High). The threat level is High due to the potential for remote, unauthenticated crashes in critical healthcare infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the dcmnet module, which implements the DICOM network communication protocol. DIMSE messages are used for DICOM operations like C-STORE (store images), C-FIND (query), and C-MOVE (move data). The flaw is a NULL pointer dereference (CWE-476) triggered by an invalid DIMSE message. When the library attempts to parse or process a malformed message, it fails to properly validate a pointer before dereferencing it, leading to a segmentation fault. This can be triggered by sending a DICOM message with a corrupted or missing required field, such as an invalid command set length or a malformed presentation context.

Vulnerable vs. Patched Code

The fix in DCMTK 3.6.9 likely involves adding NULL pointer checks before dereferencing pointers in the DIMSE message parsing routines. A typical vulnerable code pattern might look like:

// Vulnerable code (simplified)
void processDIMSEMessage(DUL_PresentationContext *ctx, DUL_DATA *data) {
    // Assume ctx is valid
    DUL_ServiceProvider *sp = ctx->provider; // Potential NULL dereference
    sp->handleMessage(data);
}

The patched version would add a check:

// Patched code (simplified)
void processDIMSEMessage(DUL_PresentationContext *ctx, DUL_DATA *data) {
    if (ctx == NULL || ctx->provider == NULL) {
        // Log error and return gracefully
        return;
    }
    DUL_ServiceProvider *sp = ctx->provider;
    sp->handleMessage(data);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Set up a vulnerable DCMTK instance (version < 3.6.9) running a DICOM SCP (Service Class Provider) on port 11112.
2. Use a tool like dicom (Python library) or storescp (from DCMTK) to simulate a listener.

Exploitation Steps:

1. Craft a malformed DIMSE message. Since no public exploit exists, you must manually construct a DICOM message with an invalid command set length or a corrupted presentation context.
2. Send the malformed message to the target using a raw socket or a DICOM library.
3. Observe the target process crash (segmentation fault).

Example Python script (conceptual):

import socket

def send_malformed_dicom(target_ip, target_port=11112):
    # Craft a minimal DICOM message with an invalid field
    # This is a simplified example; real exploit requires deep DICOM knowledge
    malformed_pdu = b"\x01\x00\x00\x00"  # Invalid PDU type
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(malformed_pdu)
    sock.close()

if __name__ == "__main__":
    send_malformed_dicom("192.168.1.100")

Blue Team

Detection:

• Monitor for DICOM connections (port 11112) with malformed or incomplete PDUs.
• Use network intrusion detection systems (NIDS) to flag anomalous DICOM traffic.
• Enable application-level logging in DCMTK to capture crash events.

Mitigation:

• Immediately upgrade to DCMTK 3.6.9 or later.
• If patching is not possible, restrict network access to DICOM services using firewalls or VPNs.
• Implement input validation and sanitization for DICOM messages at the network perimeter.

Indicators of Compromise (IOCs)

• Network: DICOM traffic on port 11112 with malformed PDU headers (e.g., invalid PDU type, length mismatches).
• System: Segmentation fault logs in application logs (e.g., dcmtk: segfault at ...).
• Process: Crash of DICOM SCP processes (e.g., storescp, dcmqrscp).

Detection Engineering

YARA Rule

rule CVE_2024_34508_DCMTK_DIMSE_Crash {
    meta:
        description = "Detects malformed DICOM DIMSE messages targeting CVE-2024-34508"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34508"
    strings:
        $dicom_header = { 01 00 00 00 }  // Example malformed PDU
        $dimse_crash = { 00 00 00 00 }   // Example invalid field
    condition:
        $dicom_header at 0 and $dimse_crash
}

Sigma Rule

title: DICOM Malformed Message Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic with malformed DICOM DIMSE messages
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 11112
        payload|contains: "01000000"  # Hex representation of malformed PDU
    condition: selection
falsepositives:
    - Legitimate DICOM traffic with unusual but valid PDUs
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2024-34508 DCMTK DIMSE Crash Attempt"; flow:to_server,established; content:"|01 00 00 00|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade DCMTK to version 3.6.9 or later. This is the only definitive fix.
2. Compensating Controls: If patching is delayed, restrict network access to DICOM services (port 11112) to trusted IP addresses only. Use network segmentation and firewalls.
3. Monitoring: Enable detailed logging for DICOM services and monitor for crash events. Deploy the provided Suricata rule to detect exploitation attempts.
4. Vendor Contact: If using a commercial product that bundles DCMTK, contact the vendor for a patched version.

Valters IT