CVE-2023-35949
📋 TL;DR
CVE-2023-35949 is a stack-based buffer overflow vulnerability in libigl's OFF file parser that allows arbitrary code execution when processing malicious .off files. This affects applications using libigl v2.4.0 for 3D geometry processing. Attackers can exploit this by tricking users or automated systems into opening specially crafted OFF files.
💻 Affected Systems
- libigl
📦 What is this software?
Libigl by Libigl
Libigl by Libigl
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the vulnerable application, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Application crash leading to denial of service, or limited code execution within the application's context allowing data exfiltration or further system exploitation.
If Mitigated
Application crash without code execution if memory protections (ASLR, DEP) are effective, or safe failure if input validation blocks malicious files.
🎯 Exploit Status
Exploitation requires delivering a malicious OFF file to the vulnerable application. The Talos Intelligence report includes technical details that could facilitate exploit development.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.5.0 or later
Vendor Advisory: https://github.com/libigl/libigl/releases
Restart Required: Yes
Instructions:
1. Update libigl to version 2.5.0 or later. 2. Recompile any applications using libigl. 3. Restart affected applications and services.
🔧 Temporary Workarounds
Input validation for OFF files
allImplement strict validation of OFF file headers and geometry data before passing to libigl parser
Sandbox parsing process
allRun OFF file parsing in isolated container or sandbox with limited privileges
🧯 If You Can't Patch
- Disable OFF file processing in affected applications if possible
- Implement network segmentation to isolate systems using vulnerable libigl versions
🔍 How to Verify
Check if Vulnerable:
Check if application uses libigl v2.4.0 and includes readOFF.cpp functionality. Review source code or dependencies for libigl version.Check Version:
Check build configuration or dependency files for libigl version. For compiled applications, use strings command or dependency analysis tools.Verify Fix Applied:
Verify libigl version is 2.5.0 or later. Test with known safe OFF files to ensure functionality remains.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing OFF files
- Memory access violation errors in application logs
- Unexpected process termination during file parsing
Network Indicators:
- Unusual OFF file downloads from untrusted sources
- Large or malformed OFF files being transferred
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "access violation" OR "buffer overflow") AND process="*libigl*" OR file_extension=".off"