CVE-2020-28633

Vulnerability

An out-of-bounds read vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal, specifically in Nef_S2/SNC_io_parser.h within the SNC_io_parser::read_sedge() function when handling seh->prev(). The vulnerability affects CGAL version 5.1.1 [1]. The flaw stems from improper validation of array indices (CWE-129) [1] during parsing of specially crafted malformed .nef3 files [1].

Exploitation

An attacker can trigger the vulnerability by providing a malformed file as input to any application that uses the CGAL library for parsing Nef polygons, such as OpenSCAD [1]. No authentication or user interaction beyond processing the file is required [1]. The attacker does not need any special network position, as the file can be supplied locally or via network delivery [1].

Impact

Successful exploitation leads to an out-of-bounds read and type confusion, which could result in arbitrary code execution in the context of the process using CGAL [1]. The CVSSv3 score is 10.0, indicating complete compromise of confidentiality, integrity, and availability [1].

Mitigation

The CGAL project has addressed these vulnerabilities in versions after 5.1.1. Gentoo Linux recommends upgrading to >=sci-mathematics/cgal-5.4.1 [2]. No workarounds are known [2]. Users should update to the latest CGAL release to mitigate this vulnerability.