PT-2021-21555 · Siemens · Solid Edge

Xina1I · Published 2021-08-10 · Updated 2021-12-16 · CVE-2021-37179

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Solid Edge SE2021 versions prior to SE2021MP7

Description A vulnerability has been identified in the PSKERNEL.dll library, which lacks proper validation while parsing user-supplied OBJ files. This could lead to a use-after-free condition, allowing an attacker to execute code in the context of the current process.

Recommendations For Solid Edge SE2021 versions prior to SE2021MP7, update to SE2021MP7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the PSKERNEL.dll library when parsing OBJ files from untrusted sources until a patch is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-37179

ZDI-21-1114

Affected Products

Solid Edge

References · 5

• https://zerodayinitiative.com/advisories/ZDI-21-1114 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37179 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37179 · Vendor Advisory
• https://t.me/cibsecurity/27053 · Telegram Post