CVE-2020-28632

Vulnerability

Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality of CGAL libcgal version 5.1.1 [1]. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, specifically in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sedge() when handling seh->incident_sface() [1]. The affected code is reachable when parsing .nef3 files [1].

Exploitation

An attacker can provide a malicious input file to trigger any of these vulnerabilities [1]. No authentication or special privileges are required, as the parsing occurs with user-controlled input [1]. The out-of-bounds read and type confusion occur during the parsing process, allowing the attacker to corrupt memory [1].

Impact

Successful exploitation leads to arbitrary code execution due to the out-of-bounds read and type confusion [1]. The attacker can achieve full control over the affected application, compromising confidentiality, integrity, and availability [1]. The CVSS score is 10.0, indicating critical severity with network exploitation, no privileges required, and no user interaction needed [1].

Mitigation

As of the available references, there is no known workaround [2]. The Gentoo security advisory recommends upgrading to CGAL version 5.4.1 or later, which contains fixes for these vulnerabilities [2]. Users should update to the latest version as soon as possible.