CVE-2020-28621

Vulnerability

An out-of-bounds read vulnerability exists in the SNC_io_parser::read_edge() function within Nef_S2/SNC_io_parser.h of CGAL libcgal version 5.1.1 [1]. The flaw occurs when parsing a specially crafted malformed .nef3 file, leading to an out-of-bounds read and type confusion in the eh->out_sedge() call. This vulnerability is part of a larger set of code execution issues in the Nef polygon-parsing functionality [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious .nef3 file to an application that uses CGAL to parse Nef polygons. No authentication or special network position is required; the attack can be delivered remotely if the application accepts user-supplied files [1]. The attacker crafts a malformed file that triggers the out-of-bounds read during parsing, potentially leading to type confusion [1].

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the process using CGAL. The CVSSv3 score is 10.0, indicating a complete compromise of confidentiality, integrity, and availability (CIA) [1]. The attacker gains full control over the affected system.

Mitigation

The vulnerability is fixed in CGAL version 5.4.1 and later [2]. Users should upgrade to this version or newer. There is no known workaround for this issue [2]. The Gentoo security advisory (GLSA 202305-34) recommends upgrading all CGAL installations [2].