CVE-2024-28584

What it actually does

Null pointer dereference in the J2KImageToFIBITMAP function causes an application crash when parsing specially crafted J2K image data.

Why it matters to the business

Local users or automated processes that handle J2K images can trigger application crashes, leading to service interruptions on systems using the vulnerable library; the issue has been public for over two years with negligible observed exploitation.

How an attack unfolds

An attacker with local access supplies a malformed J2K image file to any application linked against the vulnerable FreeImage library; the J2KImageToFIBITMAP function dereferences a null pointer during image conversion and terminates the process.

How to fix it

Upgrade libudisks2-devel on AlmaLinux 8 to version 2.9.0-3.el8 or later; rebuild any dependent applications against the patched library and restart affected services.

How to confirm the fix worked

Confirm the installed package version is at least 2.9.0-3.el8, then attempt to process a known-good J2K image with the updated library to verify continued functionality without crashes on valid input.

Typical attack path

1. Obtain or craft a J2K image file that triggers the null pointer path
2. Invoke an application that uses FreeImage to open or convert the file
3. Trigger the crash via J2KImageToFIBITMAP to achieve local denial of service

How to detect it

Review application and system logs for unexpected process terminations or segmentation faults occurring during image processing routines; no widespread threat actor activity or ransomware campaigns have been associated with this issue.

What your security team should do

• Apply the AlmaLinux package update immediately on all systems running libudisks2-devel
• Scan for any custom builds or statically linked copies of FreeImage 3.19.0 and replace them
• Add J2K image handling to application hardening and fuzzing test suites