CVE-2020-35628

Vulnerability

An out-of-bounds read vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal version CGAL-5.1.1. The flaw resides in the SNC_io_parser::read_sloop() function within Nef_S2/SNC_io_parser.h, specifically when accessing slh->incident_sface. The parser fails to validate array indices, leading to an out-of-bounds read. This issue is classified as CWE-129 (Improper Validation of Array Index) [1].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted malformed .nef3 file to an application that uses the CGAL library to parse Nef polygons. No authentication or user interaction is required beyond opening the malicious file. The out-of-bounds read can trigger a type confusion, which an attacker can leverage to achieve code execution [1].

Impact

Successful exploitation results in arbitrary code execution with the privileges of the process using the CGAL library. The CVSSv3 score is 10.0 (Critical), indicating a complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with a network attack vector and no privileges required [1].

Mitigation

The vulnerability is fixed in CGAL version 5.4.1 and later. Users should upgrade to this version or newer. No known workaround exists for this issue [4]. The Gentoo security advisory (GLSA 202305-34) recommends upgrading to >=sci-mathematics/cgal-5.4.1 [4].