CVE-2024-28570

What it actually does

Buffer overflow in the processMakerNote() function during JPEG image parsing leads to denial of service.

Why it matters to the business

Local users can crash affected image-processing applications, disrupting availability of dependent services on AlmaLinux systems without widespread ransomware or remote exploitation risk.

How an attack unfolds

An attacker with local access supplies a crafted JPEG image to any application using the vulnerable FreeImage library; the malformed maker note triggers the overflow inside processMakerNote() and terminates the process.

How to fix it

Upgrade pmix and pmix-devel packages on AlmaLinux 8 to version 2.2.4rc1-1.el8 or later; rebuild or redeploy any software statically linked against the vulnerable FreeImage 3.19.0 release.

How to confirm the fix worked

Verify installed package versions match or exceed 2.2.4rc1-1.el8; test image ingestion with known-good and known-malformed JPEG samples to confirm the process no longer crashes.

Typical attack path

1. Obtain local access or ability to supply image files to a process using FreeImage
2. Prepare a JPEG containing a malformed EXIF maker note designed to overflow the buffer
3. Cause the target application to call processMakerNote() while reading the image
4. Trigger the overflow resulting in denial of service

How to detect it

Review application crash logs and core dumps for references to processMakerNote or FreeImage when JPEG files are processed; correlate with file-access timestamps of suspicious images.

What your security team should do

• Apply the AlmaLinux package updates immediately on all systems running the affected pmix packages
• Scan source and binary dependencies for any other copies of FreeImage 3.19.0
• Restrict local user ability to supply untrusted images to high-value processes until patches are deployed