CVE-2024-28581

What it actually does

Buffer overflow in the _assignPixel<>() function during TARGA image parsing in FreeImage 3.19.0 allows a local attacker to overwrite memory and execute arbitrary code.

Why it matters to the business

A local attacker can run malicious code on affected systems, potentially leading to unauthorized access, data theft, or system compromise on Linux environments using the vulnerable graphics libraries.

How an attack unfolds

An attacker supplies a specially crafted TARGA image file to any application that uses the vulnerable FreeImage library for image loading; when the _assignPixel function processes the malformed image data, the overflow occurs and control flow is redirected to attacker-supplied code.

How to fix it

Upgrade all affected AlmaLinux 8 packages to the listed fixed versions: libwacom-devel to 1.1-3.el8, mesa-libOSMesa-devel and mesa-libgbm-devel to 20.1.4-1.el8, glx-utils to 8.4.0-5.20181118git1830dcb.el8, intel-gpu-tools to 2.99.917-39.20200205.el8, and the remaining libX* and libvdpau packages to their respective fixed versions (1.0.9-3.el8 through 1.4-2.el8).

How to confirm the fix worked

Verify installed package versions match or exceed the fixed versions; re-test image loading functionality with TARGA files to confirm the overflow condition is resolved.

Typical attack path

1. Identify or gain access to a local account on a system with vulnerable packages installed
2. Craft a malicious TARGA image that triggers the buffer overflow in _assignPixel
3. Cause a local application to open the image using FreeImage
4. Execute arbitrary code via the resulting memory corruption

How to detect it

Review system logs for unexpected crashes or segfaults in processes using FreeImage or the listed X11/mesa libraries when handling TARGA files; inspect application error logs and core dumps for signs of memory corruption during image parsing.

What your security team should do

• Apply the listed package updates immediately on all AlmaLinux 8 systems
• Scan for and replace any remaining installations of FreeImage 3.19.0 or earlier
• Restrict local user ability to process untrusted image files until patches are deployed