PT-2024-12522 · Libigl · Libigl

Carl Hurd · Published 2024-05-28 · Updated 2024-06-10 · CVE-2023-35949

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libigl version 2.4.0

Description The issue is related to multiple stack-based buffer overflow vulnerabilities in the readOFF.cpp functionality. These vulnerabilities can be triggered by a specially-crafted .off file, leading to a buffer overflow and allowing an attacker to execute arbitrary code. The vulnerabilities exist within the code responsible for parsing geometric faces of an OFF file.

Recommendations For libigl version 2.4.0, consider disabling the readOFF.cpp functionality until a patch is available to prevent potential exploitation. Restrict access to .off files to minimize the risk of triggering the buffer overflow vulnerabilities. Avoid using the readOFF.cpp functionality to parse geometric faces of an OFF file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2023-35949

Affected Products

Libigl

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1784 · Exploit
• https://ubuntu.com/security/CVE-2023-35949 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35949 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35949 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-35949 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-35949 · Security Note
• https://t.me/cvenotify/81166 · Telegram Post
• https://t.me/cvenotify/81189 · Telegram Post