CVE-2024-9029: Freeimage: heap buffer overflow in tiff_read_iptc_profile
A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the readiptcprofile function in the Source/Metadata/IPTC.cpp file because the size of the profile is not being sanitized, causing a crash in the application linked to the library, resulting in a denial of service.
Other sources
While doing fuzzing with AFL++ & Sydr. I found heap buffer overflow in readiptcprofile:
==376632==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000091 at pc 0x000000730e1d bp 0x7fffffffda90 sp 0x7fffffffda88 READ of size 1 at 0x602000000091 thread T0 [Detaching after fork from child process 376675] #0 0x730e1c in readiptcprofile /freeimage-svn/FreeImage/trunk/Source/Metadata/IPTC.cpp:74:7 #1 0x654cae in tiffreadiptcprofile(tiff, FIBITMAP) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:790:10 #2 0x654cae in ReadMetadata(FreeImageIO, void, tiff, FIBITMAP) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:871:2 #3 0x64e5a2 in Load(FreeImageIO, void, int, int, void) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:2320:3 #4 0x508deb in FreeImageLoadFromHandle /freeimage-svn/FreeImage/trunk/Source/FreeImage/Plugin.cpp:386:24 #5 0x4ff0bb in FreeImageLoadFromMemory /freeimage-svn/FreeImage/trunk/Source/FreeImage/MemoryIO.cpp:88:10 #6 0x4e0505 in LLVMFuzzerTestOneInput /loadfrommemorytifffuzzer.cc:35:26 #7 0x4e00c4 in main /afl.cc:36:9 #8 0x7ffff7a730b2 in libcstartmain /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 #9 0x425fbd in start (/loadfrommemorytiffafl+0x425fbd)
In File /freeimage-svn/FreeImage/trunk/Source/Metadata/IPTC.cpp:74
71 // find start of the BIM portion of the binary data 72 sizet offset = 0; 73 while(offset < length - 1) { --->74 if((profile[offset] == 0x1C) && (profile[offset+1] == 0x02)) 75 break; 76 offset++; 77 } 78 79 // for each tag 80 while (offset < length) { 81 82 // identifies start of a tag
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9029?
CVE-2024-9029 has been classified with a high severity due to its potential to cause application crashes.
How do I fix CVE-2024-9029?
To fix CVE-2024-9029, you should update to the latest version of the FreeImage library that addresses this vulnerability.
What type of vulnerability is CVE-2024-9029?
CVE-2024-9029 is a buffer over-read vulnerability found in the read_iptc_profile function of the FreeImage library.
What software is affected by CVE-2024-9029?
CVE-2024-9029 affects the FreeImage library, specifically in applications that utilize this library for image processing.
What happens if I don't address CVE-2024-9029?
Failing to address CVE-2024-9029 may lead to application crashes and potential denial of service in software relying on the vulnerable library.