CVE-2024-24684

Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function. We can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-28 14:15

Updated : 2024-06-10 18:15

NVD link : CVE-2024-24684

Mitre link : CVE-2024-24684

CVE.ORG link : CVE-2024-24684

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2024-24684", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-05-28T14:15:11.830", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "source": "talos-cna@cisco.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "source": "talos-cna@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function. \r\n\r\n\r\nWe can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria en la funcionalidad readOFF de libigl v2.5.0. Un archivo .off especialmente manipulado puede provocar un desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad. Esta vulnerabilidad se refiere al an\u00e1lisis del encabezado que se produce al procesar un archivo \".off\" a trav\u00e9s de la funci\u00f3n \"readOFF\". Podemos ver arriba que en [0] se define un b\u00fafer basado en pila llamado \"comentario\" con un tama\u00f1o codificado de \"1000 bytes\". La llamada a `fscanf` en [1] no es segura y si la primera l\u00ednea del encabezado de los archivos `.off` tiene m\u00e1s de 1000 bytes, desbordar\u00e1 el b\u00fafer del `header`."}], "lastModified": "2024-06-10T18:15:26.487", "sourceIdentifier": "talos-cna@cisco.com"}