CVE-2020-35633
📋 TL;DR
This vulnerability allows remote code execution through a specially crafted file that triggers an out-of-bounds read and type confusion in CGAL's Nef polygon-parsing functionality. Attackers can exploit this by providing malicious input to applications using the vulnerable library. Systems using CGAL for computational geometry operations are affected.
💻 Affected Systems
- CGAL (Computational Geometry Algorithms Library)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary code execution leading to data theft, system takeover, or lateral movement within the network.
Likely Case
Application crash (denial of service) or limited code execution within the context of the vulnerable application.
If Mitigated
Application crash with no code execution if memory protections (ASLR, DEP) are effective.
🎯 Exploit Status
Exploitation requires crafting a specific malformed file and getting it processed by vulnerable application. Talos Intelligence has published detailed analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CGAL-5.1.2 and later
Vendor Advisory: https://www.cgal.org/
Restart Required: Yes
Instructions:
1. Update CGAL to version 5.1.2 or later. 2. Recompile any applications using CGAL. 3. Restart affected services/applications.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation of polygon files before processing with CGAL
Disable Nef Polygon Parsing
allIf not required, disable or remove Nef polygon functionality from application
🧯 If You Can't Patch
- Isolate systems using CGAL behind network segmentation
- Implement strict file upload controls and sandbox processing of geometry files
🔍 How to Verify
Check if Vulnerable:
Check CGAL version: dpkg -l | grep libcgal (Debian/Ubuntu) or rpm -qa | grep -i cgal (RHEL/CentOS)Check Version:
For source installations: check CGAL version in source code or configuration filesVerify Fix Applied:
Verify CGAL version is 5.1.2 or higher and applications have been recompiled📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing geometry files
- Memory access violation errors in application logs
Network Indicators:
- Unusual file uploads to geometry processing services
SIEM Query:
source="application.log" AND ("segmentation fault" OR "access violation" OR "out of bounds") AND process="*cgal*"🔗 References
- https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html
- https://security.gentoo.org/glsa/202305-34
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
- https://lists.debian.org/debian-lts-announce/2022/12/msg00011.html
- https://security.gentoo.org/glsa/202305-34
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
