CVE-2018-3841

Vulnerability

A null pointer dereference vulnerability exists in the Pixar Renderman IT Display Service version 21.6 (0x69). The bug lies in the parsing of a network packet on port 4001, where the 0x69 command reads data via a socket read without validating the resulting string. If the string is null, the code dereferences offset 0x68 of a null pointer, causing a crash [1]. The service is started by a user and listens for connections from any host.

Exploitation

An attacker needs network access to the host running the IT Display Service and must connect to port 4001. No authentication is required. The attacker sends a specially crafted packet that invokes the 0x69 command and causes the unvalidated socket read to produce a null string [1]. The sequence is: open connection, send malformed packet targeting the vulnerable command handler.

Impact

Successful exploitation results in a denial-of-service (DoS) condition where the IT Display Service crashes. The vulnerability does not allow code execution or data exfiltration; the CVSS v3.0 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) [1].

Mitigation

Pixar has not released a fixed version in the available references [1]. Users should restrict network access to port 4001 to trusted hosts only and consider disabling the IT Display Service if not required. No KEV listing has been published.