CVE-2024-23140
📋 TL;DR
This vulnerability allows attackers to exploit out-of-bounds read conditions in Autodesk applications when processing malicious 3DM and MODEL files. Attackers could crash applications, read sensitive memory data, or potentially execute arbitrary code. Users of affected Autodesk software are at risk.
💻 Affected Systems
- Autodesk applications using opennurbs.dll and atf_api.dll
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes causing denial of service and potential data corruption or limited information disclosure.
If Mitigated
Application crash with no data loss if proper file validation and sandboxing are implemented.
🎯 Exploit Status
Requires user to open malicious file. No public exploit code known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions specified in Autodesk Security Advisory ADSK-SA-2024-0009
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
Restart Required: Yes
Instructions:
1. Identify affected Autodesk products. 2. Check Autodesk Account or product update mechanism. 3. Apply latest security updates. 4. Restart affected applications.
🔧 Temporary Workarounds
Restrict file types
allBlock or restrict 3DM and MODEL files from untrusted sources
Application sandboxing
allRun Autodesk applications in restricted environments
🧯 If You Can't Patch
- Implement strict file validation policies for 3DM/MODEL files
- Use application whitelisting to prevent unauthorized Autodesk software execution
🔍 How to Verify
Check if Vulnerable:
Check Autodesk product version against advisory. Review if opennurbs.dll or atf_api.dll are present.Check Version:
Check via Autodesk product 'About' dialog or Windows 'Programs and Features'Verify Fix Applied:
Verify product version matches patched versions in advisory. Check file hashes of updated DLLs.📡 Detection & Monitoring
Log Indicators:
- Application crashes from Autodesk software
- Memory access violation errors
- Unexpected file parsing errors
Network Indicators:
- Downloads of 3DM/MODEL files from untrusted sources
- Unusual outbound connections after file opens
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName contains 'Autodesk' AND ExceptionCode=c0000005