CVE-2024-37004
📋 TL;DR
A use-after-free vulnerability in ASMKERN229A.dll when parsing malicious SLDPRT files in Autodesk applications could allow remote code execution. This affects users who open untrusted SolidWorks part files in vulnerable Autodesk software. Attackers could exploit this by tricking users into opening specially crafted files.
💻 Affected Systems
- Autodesk applications using ASMKERN229A.dll for SLDPRT file parsing
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the current user, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or limited code execution in the context of the Autodesk application process.
If Mitigated
Application crash without code execution if exploit fails or security controls block it.
🎯 Exploit Status
Exploitation requires user to open a malicious file; no authentication bypass needed but user interaction is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk security advisory ADSK-SA-2024-0009 for specific patched versions.
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
Restart Required: Yes
Instructions:
1. Visit the Autodesk security advisory. 2. Identify affected products and versions. 3. Update to the latest patched version via Autodesk Account or application update mechanism. 4. Restart the application and system if prompted.
🔧 Temporary Workarounds
Block SLDPRT file extensions
allPrevent opening of SLDPRT files at the system or network level to reduce attack surface.
User awareness training
allEducate users to avoid opening untrusted SLDPRT files from unknown sources.
🧯 If You Can't Patch
- Restrict user permissions to limit potential damage from code execution.
- Use application whitelisting to block unauthorized executables from running.
🔍 How to Verify
Check if Vulnerable:
Check if ASMKERN229A.dll version is vulnerable by comparing with patched versions listed in Autodesk advisory.Check Version:
Check via Autodesk application 'About' menu or system file properties for ASMKERN229A.dll.Verify Fix Applied:
Verify application version matches or exceeds patched version from Autodesk advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes related to ASMKERN229A.dll
- Unexpected process creation from Autodesk applications
Network Indicators:
- Downloads of SLDPRT files from untrusted sources
SIEM Query:
Process creation events from Autodesk executables followed by crash logs or suspicious network activity.