CVE-2024-37002
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious MODEL files in affected Autodesk applications. It affects users of Autodesk software that uses the vulnerable ASMkern229A.dll library. The exploit leverages uninitialized variables to achieve code execution in the current process.
💻 Affected Systems
- Autodesk applications using ASMkern229A.dll
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware execution when users open malicious MODEL files, potentially leading to data exfiltration or system disruption.
If Mitigated
Limited impact with proper application whitelisting and user training preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions specified in Autodesk advisory ADSK-SA-2024-0009
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
Restart Required: Yes
Instructions:
1. Review Autodesk advisory ADSK-SA-2024-0009. 2. Identify affected products and versions. 3. Download and install the latest security updates from Autodesk. 4. Restart affected applications and systems.
🔧 Temporary Workarounds
Restrict MODEL file execution
windowsBlock execution of MODEL files from untrusted sources using application control policies.
Use Windows AppLocker or similar to block .model files from untrusted locations
User awareness training
allTrain users to avoid opening MODEL files from unknown or untrusted sources.
🧯 If You Can't Patch
- Implement strict application whitelisting to prevent execution of unauthorized files
- Use network segmentation to isolate Autodesk workstations from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if ASMkern229A.dll version matches vulnerable versions listed in Autodesk advisoryCheck Version:
On Windows: wmic datafile where name='C:\\Path\\To\\ASMkern229A.dll' get versionVerify Fix Applied:
Verify ASMkern229A.dll has been updated to patched version and check Autodesk application version against patched versions📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Autodesk applications
- Failed attempts to load MODEL files
- Crash reports from ASMkern229A.dll
Network Indicators:
- Unexpected outbound connections from Autodesk applications
- Downloads of MODEL files from suspicious sources
SIEM Query:
Process creation where parent process contains 'autodesk' AND command line contains '.model'