CVE-2024-28580

What it actually does

Buffer overflow in ReadData() during RAS image parsing allows arbitrary code execution in the context of the local user process.

Why it matters to the business

Local attackers can gain code execution on systems that process RAS images, risking full system compromise and disruption of any dependent applications or services.

How an attack unfolds

An attacker supplies a crafted RAS image file that triggers the ReadData() buffer overflow in FreeImage when the image is opened or processed by an affected application.

How to fix it

Upgrade nodejs-nodemon to 2.0.3-1.module_el8.4.0+2521+c668cc9f and nodejs-packaging to 23-3.module_el8.5.0+254+b4526b16 on AlmaLinux 8; rebuild or redeploy any downstream images or containers that embed the vulnerable FreeImage library.

How to confirm the fix worked

Confirm installed package versions match the fixed releases, run regression tests that exercise RAS image loading, and verify no crashes or unexpected behavior occur with known-good and edge-case RAS files.

Typical attack path

1. Obtain or create a malicious RAS format image file
2. Cause a vulnerable application to invoke FreeImage ReadData() on the file
3. Trigger buffer overflow to redirect execution
4. Execute arbitrary code under the privileges of the calling process

How to detect it

Review application and system logs for crashes or unusual process spawns during RAS image handling; correlate with file access events involving .ras files.

What your security team should do

• Apply the listed package updates on all AlmaLinux 8 hosts within the next maintenance window
• Inventory and replace any custom builds or containers shipping FreeImage 3.19.0
• Limit local user access and untrusted image processing jobs until patches are deployed