CVE-2024-22391: 
Linux Debian vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2024-22391) exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. The vulnerability was discovered by Emmanuel Tacheau of Cisco Talos and publicly disclosed on April 25, 2024. This vulnerability affects the DICOM library's ability to handle specially crafted malformed files, which can lead to memory corruption (Talos Report).

The vulnerability occurs in the LookupTable::SetLUT function where there is a missing size check for a buffer memory. The issue arises because there is no verification of Internal->RGB[3*i+type] size against Internal->Length[type], which can lead to a heap-based buffer overflow. The vulnerability has been assigned a CVSS v3.1 score of 7.7 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H, indicating network accessibility with high attack complexity (Talos Report).

When exploited, this vulnerability can lead to memory corruption through a heap-based buffer overflow. The potential impacts include low confidentiality impact and high integrity and availability impacts, as indicated by the CVSS score. An attacker can trigger this vulnerability by providing a malicious file to the application (Talos Report).

The vulnerability can be exploited by providing a specially crafted malformed DICOM file to the application. The attack vector is network-based (AV:N) but requires high attack complexity (AC:H). No privileges (PR:N) or user interaction (UI:N) are required for exploitation (Talos Report).

The vendor has released a fix for this vulnerability on their sourceforge site. Users should upgrade to a version newer than 3.0.23. The timeline for the fix includes: vendor contact on February 15, 2024, vendor disclosure on February 20, 2024, and patch release on February 21, 2024 (Talos Report).