CVE-2020-28602

Vulnerability

An out-of-bounds read vulnerability exists in the Nef_2/PM_io_parser.h file of CGAL libcgal version 5.1.1, specifically in the PM_io_parser::read_vertex() function when parsing Halfedge_of[] indices. This flaw occurs within the Nef polygon-parsing functionality, where a specially crafted malformed .nef3 file can trigger an out-of-bounds read and type confusion, potentially leading to code execution. The vulnerability is present in CGAL versions up to 5.1.1, as reported by Cisco Talos [1].

Exploitation

An attacker can exploit this vulnerability by providing a maliciously crafted Nef polygon file (e.g., .nef3) to an application that uses the CGAL library to parse such files. No authentication or special network position is required if the application processes untrusted input. The attacker must craft the file to cause an out-of-bounds read in the read_vertex() function, leading to a type confusion condition.

Impact

Successful exploitation could allow an attacker to execute arbitrary code in the context of the process using CGAL. This can result in full compromise of confidentiality, integrity, and availability. The CVSSv3 score for similar issues is 10.0 (Critical) [1].

Mitigation

The vulnerability is addressed in CGAL version 5.4.1 and later [2]. Users should upgrade to this version or later. No known workaround exists for unpatched versions. The Gentoo security advisory (GLSA 202305-34) recommends upgrading to >=sci-mathematics/cgal-5.4.1 [2].