CVE-2023-35953
📋 TL;DR
This vulnerability allows arbitrary code execution via stack-based buffer overflow when libigl parses malicious .off files. Attackers can exploit specially crafted files to execute code on affected systems. Users of applications that incorporate libigl for 3D geometry processing are affected.
💻 Affected Systems
- libigl
📦 What is this software?
Libigl by Libigl
Libigl by Libigl
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, enabling data theft, lateral movement, and persistent access.
Likely Case
Application crash leading to denial of service, with potential for remote code execution if attacker can deliver malicious .off files.
If Mitigated
Application crash without code execution if memory protections like ASLR/DEP are effective, but availability impact remains.
🎯 Exploit Status
Exploitation requires delivering a malicious .off file to the vulnerable application; no authentication needed for file parsing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.5.0 or later
Vendor Advisory: https://github.com/libigl/libigl/releases
Restart Required: Yes
Instructions:
1. Update libigl to version 2.5.0 or later. 2. Recompile any applications using libigl. 3. Restart affected applications/services.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation of .off files before processing with libigl
Memory Protection
linuxEnable ASLR, DEP, and stack canaries in compiled applications
gcc -fstack-protector-all -D_FORTIFY_SOURCE=2
🧯 If You Can't Patch
- Isolate applications using libigl in restricted network segments
- Implement application allowlisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check if application uses libigl version 2.4.0 or earlier and processes .off filesCheck Version:
Check library version in source code or build configurationVerify Fix Applied:
Verify libigl version is 2.5.0 or later and applications have been recompiled📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing .off files
- Memory access violation errors
Network Indicators:
- Unusual .off file uploads to affected applications
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "access violation") AND "*.off"