CVE-2020-36149

Vulnerability

The changeAttribute function in tools.c of the libmysofa library (versions 0.5 through 1.1, and master as of 2020-08-26) incorrectly handles input data, leading to a NULL pointer dereference on the attr->value variable. The vulnerability is triggered when a maliciously crafted HRTF (Head-Related Transfer Function) file is opened with mysofa_open or related API calls [1].

Exploitation

An attacker needs only to supply a specially crafted HRTF file to an application using libmysofa. No authentication or special network position is required beyond delivering the file to the parsing code (e.g., via a web upload or file share). The crash reproduces reliably when the file is processed by mysofa_open, which calls mysofa_open_default, then mysofa_tocartesian, and ultimately the vulnerable changeAttribute at line 37 of tools.c [1]. The segmentation fault occurs due to the NULL pointer dereference in strcmp called on attr->value.

Impact

Successful exploitation results in a NULL pointer dereference, causing a segmentation fault and denial of service (application crash). In environments with restrictive memory protection (e.g., standard Linux user-space), the process terminates with SIGSEGV. In embedded or memory-constrained systems where memory protections are absent, this may also lead to near-NULL pointer overwrites that could potentially be leveraged further, though the primary impact is denial of service [1].

Mitigation

The libmysofa project has not released a public fix as of the CVE publication date (2021-02-08). Users should avoid processing untrusted HRTF files with affected versions (0.5 to 1.1) and monitor the project's issue tracker for a patch. The vulnerability is not known to be listed in CISA's KEV. No official workaround is documented beyond input validation at the application level [1].