PT-2021-21557 · Siemens · Solid Edge

Xina1I · Published 2021-08-10 · Updated 2021-12-16 · CVE-2021-37180

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Solid Edge SE2021 versions prior to SE2021MP7

Description A vulnerability has been identified in the PSKERNEL.dll library, which lacks proper validation while parsing user-supplied OBJ files. This could cause an out of bounds access to an uninitialized pointer, allowing an attacker to execute code in the context of the current process.

Recommendations For Solid Edge SE2021 versions prior to SE2021MP7, update to a version that includes the necessary security patches, specifically SE2021MP7 or later, to resolve the issue. As a temporary workaround, consider restricting the use of the PSKERNEL.dll library when parsing OBJ files from untrusted sources until a patch is applied.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2021-37180

ZDI-21-1113

Affected Products

Solid Edge

References · 5

• https://zerodayinitiative.com/advisories/ZDI-21-1113 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37180 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37180 · Vendor Advisory
• https://t.me/cibsecurity/27046 · Telegram Post