CVE-2020-28608

Vulnerability

In CGAL version 5.1.1, multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality. Specifically, an out-of-bounds read vulnerability is found in the function PM_io_parser::read_face() in Nef_2/PM_io_parser.h [1]. A specially crafted malformed file can trigger an out-of-bounds read and type confusion, leading to potential code execution. The vulnerability affects the Nef_2, Nef_3, and Nef_S2 parsing code [1].

Exploitation

An attacker with network access can provide a maliciously crafted .nef3 file (or other Nef format) to the application using CGAL. No authentication is required as the parsing occurs during file loading. By supplying a malformed file that triggers the out-of-bounds read and type confusion, the attacker can execute arbitrary code. The Talos advisory indicates a CVSSv3 score of 10.0, suggesting ease of exploitation [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the application using CGAL. This leads to complete compromise of confidentiality, integrity, and availability (C:I:A). The attacker could potentially take full control of the affected system.

Mitigation

The Gentoo security advisory (GLSA 202305-34) recommends upgrading to CGAL version 5.4.1 or later [2]. No known workaround exists [2]. Users should update their CGAL installations to the latest patched version to mitigate these vulnerabilities.