PT-2023-9580 · Libigl · Libigl

Philippe Laulheret · Published 2023-11-22 · Updated 2024-06-10 · CVE-2024-24685

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libigl version 2.5.0

Description Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability, which concerns the parsing of comments within the vertex section of an .off file processed via the readOFF function.

Recommendations For libigl version 2.5.0, consider disabling the readOFF function until a patch is available to prevent exploitation. Restrict access to files that could be used to trigger the buffer overflow, and avoid using the readOFF function to process untrusted .off files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2024-08486

CVE-2024-24685

Affected Products

Libigl

References · 13

• 🔥 https://github.com/SpiralBL0CK/CVE-2024-24685 · Exploit
• https://cve.org/CVERecord?id=CVE-2024-24685 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24685 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24685 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24685 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08486 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24685 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24685 · Note
• https://vuldb.com/?id.266408 · Note
• https://t.me/cvenotify/81181 · Telegram Post
• https://vulners.com/cve/CVE-2024-24685 · Note
• https://t.me/cvenotify/81204 · Telegram Post