CVE-2019-20912
📋 TL;DR
CVE-2019-20912 is a stack-based buffer overflow vulnerability in GNU LibreDWG's bit_read_TF function in bits.c. Attackers can exploit this by providing specially crafted DWG files, potentially leading to arbitrary code execution or denial of service. Users and applications that process DWG files with affected LibreDWG versions are vulnerable.
💻 Affected Systems
- GNU LibreDWG
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the LibreDWG process, potentially leading to full system compromise if the process runs with elevated privileges.
Likely Case
Application crash (denial of service) when processing malicious DWG files, potentially disrupting CAD workflows or automated processing systems.
If Mitigated
Limited impact if the application runs with minimal privileges and proper sandboxing, though service disruption remains possible.
🎯 Exploit Status
Exploitation requires providing a malicious DWG file to the vulnerable application. The GitHub issue shows proof-of-concept crash examples.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit b84c2cab55948a5ee70860779b2640913e3ee1ed
Vendor Advisory: https://github.com/LibreDWG/libredwg/commit/b84c2cab55948a5ee70860779b2640913e3ee1ed
Restart Required: Yes
Instructions:
1. Update LibreDWG to version 0.9.4 or later. 2. Rebuild any applications that link against LibreDWG. 3. Restart affected services.
🔧 Temporary Workarounds
Disable DWG file processing
allTemporarily disable LibreDWG-based DWG processing in applications until patched.
Input validation
allImplement strict validation of DWG files before passing to LibreDWG.
🧯 If You Can't Patch
- Run LibreDWG processes with minimal privileges and in sandboxed environments
- Implement network segmentation to limit access to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check LibreDWG version: redwg --version. If version is 0.9.3 or earlier, you are vulnerable.Check Version:
redwg --versionVerify Fix Applied:
Verify version is 0.9.4 or later and test with known malicious DWG files to ensure no crashes.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults when processing DWG files
- Stack overflow errors in application logs
Network Indicators:
- Unusual DWG file uploads to web applications
- Multiple failed processing attempts
SIEM Query:
source="application.log" AND ("segmentation fault" OR "stack overflow") AND process="libredwg"