CVE-2020-28606

Vulnerability

An out-of-bounds read vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal version 5.1.1, specifically in the Nef_2/PM_io_parser.h function PM_io_parser::read_hedge() when calling e->set_face(). A specially crafted malformed .nef3 file triggers an out-of-bounds read and type confusion, which could lead to code execution [1].

Exploitation

An attacker can provide a malicious input file to trigger the vulnerability. No authentication is required, and the attack can be launched over a network without any user interaction beyond processing the file. The exact sequence of steps involves parsing a crafted .nef3 file that causes an invalid array index access, leading to type confusion in the internal data structures [1].

Impact

Successful exploitation results in arbitrary code execution in the context of the process using the CGAL library. The attacker gains full control over the vulnerable system, compromising confidentiality, integrity, and availability [1]. The CVSSv3 score is 10.0, indicating critical severity with network attack vector, low complexity, and no required privileges or user interaction [1].

Mitigation

Gentoo recommended upgrading to >=sci-mathematics/cgal-5.4.1 as a fix [2]. Users should update CGAL to version 5.4.1 or later. No workaround is known for this vulnerability [2]. The issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.