CVE-2024-28566

What it actually does

Buffer overflow in FreeImage AssignPixel() during TIFF image parsing allows local arbitrary code execution with full process privileges.

Why it matters to the business

Local compromise of systems running affected resource-agents packages on AlmaLinux 8 could lead to unauthorized code execution, cluster disruption, or lateral movement; fixed versions have been available for over two years with minimal exploit activity observed.

How an attack unfolds

An attacker with local access supplies a malicious TIFF image to any process using the vulnerable FreeImage library; when AssignPixel() processes the crafted pixel data, the overflow overwrites memory to hijack control flow and execute attacker-supplied code.

How to fix it

Upgrade resource-agents, resource-agents-aliyun, resource-agents-gcp, and resource-agents-paf to version 4.9.0-16.el8 or later on AlmaLinux 8; rebuild or replace any custom packages statically linking FreeImage 3.19.0; scan for and remove untrusted TIFF files from paths processed by these components.

How to confirm the fix worked

Verify installed package versions match 4.9.0-16.el8 or newer; run FreeImage regression tests with malformed TIFF samples; confirm no remaining references to vulnerable FreeImage r1909 binaries in library paths or container images.

Typical attack path

1. Obtain local shell or user context on target host
2. Prepare malicious TIFF file exploiting AssignPixel() bounds check failure
3. Invoke affected resource-agents component or dependent application that calls FreeImage on the file
4. Trigger overflow to gain code execution and establish persistence or escalate privileges

How to detect it

Review process execution logs and file access events for resource-agents or dependent services opening unexpected TIFF files; look for segmentation faults or abnormal memory writes in FreeImage-linked processes shortly before anomalous behavior.

What your security team should do

• Immediately apply the 4.9.0-16.el8 updates across all AlmaLinux 8 systems using resource-agents
• Add package version checks to vulnerability scanning and CI pipelines
• Restrict untrusted image ingestion to processes running under least-privilege accounts
• Monitor for new EPSS increases or public exploits given the long window since disclosure