CVE-2024-55192

Executive Summary

CVE-2024-55192 is a heap overflow vulnerability discovered in OpenImageIO v3.1.0.0dev. The flaw resides in the OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*) component, which is part of the FarmHash library used internally by OpenImageIO for hashing operations. A heap overflow occurs when the Fetch64 function reads 8 bytes from a memory location without proper bounds checking, potentially leading to memory corruption, denial of service, or arbitrary code execution. The vulnerability was discovered in a development version (v3.1.0.0dev) and no official patch or advisory has been released at this time. The CVSS score is currently 0.0, indicating incomplete assessment, but the nature of the flaw suggests a high severity.

Supply Chain & Package Security

OpenImageIO is a widely used open-source library for reading, writing, and processing images in various formats. It is a dependency in many digital content creation pipelines, including VFX, animation, and scientific imaging. The vulnerability in the FarmHash component, which is a third-party hashing library bundled with OpenImageIO, introduces a supply chain risk. Any application or system that links against the vulnerable version of OpenImageIO is potentially affected. Users should verify their dependency trees and update to a patched version once available.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, indicating that the NVD has not yet assigned a full vector or score. Based on the technical details, a preliminary assessment suggests:

• Attack Vector (AV): Local (L) – exploitation likely requires local access or a crafted file.
• Attack Complexity (AC): High (H) – requires specific conditions or input.
• Privileges Required (PR): None (N) – no special privileges needed.
• User Interaction (UI): Required (R) – user must open a malicious file.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – potential for memory leak.
• Integrity (I): High (H) – potential for memory corruption.
• Availability (A): High (H) – potential for crash or denial of service.

Threat Level: High (estimated). The vulnerability is in a development branch, but if backported or present in stable releases, it could be exploited via crafted image files.

Deep Dive & Mechanics

The vulnerability is a heap overflow in the Fetch64 function within the FarmHash library. FarmHash is a family of hash functions used for fast hashing of strings and data. The Fetch64 function is designed to read 8 bytes from a given memory address in a little-endian format. The issue arises when the input pointer is not properly aligned or when the buffer size is insufficient, causing the function to read beyond the allocated heap memory.

In the context of OpenImageIO, the FarmHash library is used for hashing image metadata or pixel data. An attacker could craft a malicious image file that, when processed by OpenImageIO, triggers the heap overflow. This could lead to:

• Memory Corruption: Overwriting adjacent heap data, potentially leading to arbitrary code execution.
• Denial of Service: Crashing the application due to invalid memory access.
• Information Disclosure: Leaking sensitive data from heap memory.

The vulnerable code path is in farmhash-internal.h or similar, where Fetch64 is called without verifying that the pointer points to a valid, sufficiently sized buffer.

Vulnerable vs. Patched Code

Vulnerable Code (OpenImageIO v3.1.0.0dev):

// farmhash-internal.h (simplified)
inline uint64_t Fetch64(const char *p) {
    uint64_t result;
    memcpy(&result, p, sizeof(result)); // No bounds check
    return result;
}

The memcpy copies 8 bytes from p without ensuring that p points to a buffer of at least 8 bytes. If p is near the end of a heap buffer, this causes a heap overflow.

Patched Code (hypothetical fix):

// farmhash-internal.h (patched)
inline uint64_t Fetch64(const char *p, size_t len) {
    if (len < sizeof(uint64_t)) {
        // Handle short buffer, e.g., return 0 or throw
        return 0;
    }
    uint64_t result;
    memcpy(&result, p, sizeof(result));
    return result;
}

The patched version adds a length parameter and checks that the buffer is large enough before reading. This prevents the overflow.

Exploitation & Lab Setup

Red Team

Objective: Exploit the heap overflow to achieve code execution or denial of service.

Prerequisites:

• OpenImageIO v3.1.0.0dev (or any version with the vulnerable FarmHash code).
• Ability to supply a crafted image file (e.g., TIFF, PNG, EXR) that triggers the overflow.

Lab Setup:

1. Install OpenImageIO v3.1.0.0dev from source.
2. Create a Python script to generate a malicious image file with a crafted metadata field that causes Fetch64 to read beyond a heap buffer.
3. Use a debugger (e.g., GDB) to analyze the crash and determine if code execution is possible.

Exploit Steps:

1. Identify the vulnerable code path by fuzzing OpenImageIO with malformed images.
2. Craft a heap layout that places a function pointer or critical data after the overflow buffer.
3. Overwrite the function pointer with a controlled value to redirect execution.
4. Trigger the overflow by opening the malicious image with oiiotool or a custom application.

Note: No public exploit code is available. This is a theoretical approach.

Blue Team

Objective: Detect and prevent exploitation of CVE-2024-55192.

Detection:

• Monitor for crashes or abnormal behavior in applications using OpenImageIO.
• Use memory corruption detection tools (e.g., AddressSanitizer) during development.
• Implement file validation before processing with OpenImageIO.

Prevention:

• Update OpenImageIO to a patched version once available.
• Use sandboxing or containerization for applications that process untrusted images.
• Apply strict input validation and size checks on image metadata.

Indicators of Compromise (IOCs)

• File Hashes: (None available – no known malicious samples)
• Network Signatures: (None – local exploitation)
• Behavioral:
  • Application crash with heap corruption errors.
  • Unexpected memory access violations in farmhash::inlined::Fetch64.
  • High memory usage or abnormal process termination.

Detection Engineering

YARA Rule

rule CVE_2024_55192_HeapOverflow {
    meta:
        description = "Detects heap overflow in OpenImageIO FarmHash Fetch64"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-55192"
    strings:
        $s1 = "farmhash::inlined::Fetch64" ascii wide nocase
        $s2 = "OpenImageIO_v3_1_0" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2024-55192 Heap Overflow in OpenImageIO
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects heap overflow exploitation attempts via crafted image files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\oiiotool.exe'
        CommandLine|contains: '*.exr' or '*.tif' or '*.png'
    condition: selection
falsepositives:
    - Legitimate use of OpenImageIO with large images
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55192 OpenImageIO Heap Overflow Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder. Actual network-based detection is unlikely as the vulnerability is triggered locally.

Remediation & Mitigation

1. Immediate: Avoid using OpenImageIO v3.1.0.0dev in production. If necessary, apply strict input validation and limit file sizes.
2. Short-term: Monitor the OpenImageIO project for a patch. Consider applying a temporary fix by modifying the FarmHash source to add bounds checking.
3. Long-term: Update to a patched version once released. Review dependency management to ensure all components are up-to-date.
4. Compensating Controls: Use memory-safe languages or sandboxing for image processing. Implement AddressSanitizer in development builds.

Valters IT
DevSecOps & Cyber Threat Intelligence