CVE-2021-36080
📋 TL;DR
CVE-2021-36080 is a double-free vulnerability in GNU LibreDWG's bit_chain_free function that can lead to memory corruption and potential remote code execution. This affects applications that process DWG files using vulnerable LibreDWG library versions. Users and systems that handle DWG CAD files through LibreDWG are at risk.
💻 Affected Systems
- GNU LibreDWG
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the LibreDWG process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) when processing malicious DWG files.
If Mitigated
Limited impact if the application runs with minimal privileges and proper memory protections.
🎯 Exploit Status
Exploitation requires crafting a malicious DWG file that triggers the double-free condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.12.3.4192 and later
Vendor Advisory: https://github.com/LibreDWG/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342
Restart Required: Yes
Instructions:
1. Update LibreDWG to version 0.12.3.4192 or later. 2. Rebuild any applications using LibreDWG. 3. Restart affected services.
🔧 Temporary Workarounds
Disable DWG file processing
allTemporarily disable LibreDWG-based DWG file processing in applications.
Sandbox LibreDWG processes
linuxRun LibreDWG in a sandboxed environment with limited privileges.
🧯 If You Can't Patch
- Implement strict input validation for DWG files
- Run LibreDWG processes with minimal privileges and memory protection (ASLR, DEP)
🔍 How to Verify
Check if Vulnerable:
Check LibreDWG version: libredwg --version or check package manager. If version is between 0.12.3.4163 and 0.12.3.4191 inclusive, it's vulnerable.Check Version:
libredwg --versionVerify Fix Applied:
Verify version is 0.12.3.4192 or later. Test with known malicious DWG files if available.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing DWG files
- Memory corruption errors in application logs
Network Indicators:
- Unusual uploads of DWG files to web applications
SIEM Query:
source="application.log" AND ("segmentation fault" OR "double free" OR "corrupted") AND "libredwg"🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31724
- https://github.com/LibreDWG/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-495.yaml
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31724
- https://github.com/LibreDWG/libredwg/commit/9b6e0ff9ef02818df034fc42c3bd149a5ff89342
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-495.yaml
