CVE-2024-23947 - Vulnerability Details - OpenCVE

Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling a `binary` `.msh` file.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Libigl	Libigl

Configuration 1 [-]

cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926

History

Wed, 12 Feb 2025 19:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Libigl Libigl libigl
CPEs		cpe:2.3:a:libigl:libigl:2.5.0:::::::*
Vendors & Products		Libigl Libigl libigl

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-05-28T14:02:41.624Z

Updated: 2025-02-13T17:40:02.487Z

Reserved: 2024-01-24T12:09:19.676Z

Link: CVE-2024-23947

Vulnrichment

Updated: 2024-08-01T23:13:08.203Z

NVD

Status : Analyzed

Published: 2024-05-28T14:15:10.233

Modified: 2025-02-12T18:43:20.107

Link: CVE-2024-23947

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-23947", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-01-24T12:09:19.676Z", "datePublished": "2024-05-28T14:02:41.624Z", "dateUpdated": "2025-02-13T17:40:02.487Z"}, "containers": {"cna": {"affected": [{"vendor": "libigl", "product": "libigl", "versions": [{"version": "v2.5.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling a `binary` `.msh` file."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE", "cweId": "CWE-787"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-06-10T16:12:24.063Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}], "credits": [{"lang": "en", "value": "Discovered by Philippe Laulheret of Cisco Talos."}]}, "adp": [{"affected": [{"vendor": "libigl", "product": "libigl", "cpes": ["cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.5.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-22T16:29:17.793820Z", "id": "CVE-2024-23947", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T16:29:24.683Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:08.203Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:08.203Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-22T16:29:17.793820Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*"], "vendor": "libigl", "product": "libigl", "versions": [{"status": "affected", "version": "2.5.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T16:29:03.757Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Philippe Laulheret of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "libigl", "product": "libigl", "versions": [{"status": "affected", "version": "v2.5.0"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}], "descriptions": [{"lang": "en", "value": "Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling a `binary` `.msh` file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-28T14:02:41.624Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23947", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:13:08.203Z", "dateReserved": "2024-01-24T12:09:19.676Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-05-28T14:02:41.624Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "91BC184E-2C02-40C5-BA95-B2ADCF16C366", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling a `binary` `.msh` file."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de validaci\u00f3n de \u00edndice de matriz incorrecta en la funcionalidad readMSH de libigl v2.5.0. Un archivo .msh especialmente manipulado puede provocar una escritura fuera de los l\u00edmites. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad. Esta vulnerabilidad afecta a la funci\u00f3n `igl::MshLoader::parse_nodes` mientras maneja un archivo `binario` `.msh`."}], "id": "CVE-2024-23947", "lastModified": "2025-02-12T18:43:20.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "talos-cna@cisco.com", "type": "Secondary"}]}, "published": "2024-05-28T14:15:10.233", "references": [{"source": "talos-cna@cisco.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}, {"source": "talos-cna@cisco.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}