CVE-2024-24584 - Vulnerability Details - OpenCVE

Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.This vulnerabilitty concerns the`readMSH` function while processing `MshLoader::ELEMENT_TET` elements.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Libigl	Libigl

Configuration 1 [-]

cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-05-28T14:02:40.957Z

Updated: 2025-02-13T17:40:16.104Z

Reserved: 2024-01-25T20:01:58.464Z

Link: CVE-2024-24584

Vulnrichment

Updated: 2024-05-28T19:03:33.445Z

NVD

Status : Analyzed

Published: 2024-05-28T14:15:11.623

Modified: 2025-02-11T22:29:21.440

Link: CVE-2024-24584

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-24584", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-01-25T20:01:58.464Z", "datePublished": "2024-05-28T14:02:40.957Z", "dateUpdated": "2025-02-13T17:40:16.104Z"}, "containers": {"cna": {"affected": [{"vendor": "libigl", "product": "libigl", "versions": [{"version": "v2.5.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.This vulnerabilitty concerns the`readMSH` function while processing `MshLoader::ELEMENT_TET` elements."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE", "cweId": "CWE-125"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-06-10T16:08:04.384Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}], "credits": [{"lang": "en", "value": "Discovered by Philippe Laulheret of Cisco Talos."}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24584", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T19:07:44.199738Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*"], "vendor": "libigl", "product": "libigl", "versions": [{"status": "affected", "version": "2.5.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:42:59.609Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:19:52.934Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928", "tags": ["x_transferred"]}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-24584", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-01-25T20:01:58.464Z", "datePublished": "2024-05-28T14:02:40.957Z", "dateUpdated": "2024-05-28T14:02:40.957Z"}, "containers": {"cna": {"affected": [{"vendor": "libigl", "product": "libigl", "versions": [{"version": "v2.5.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.This vulnerabilitty concerns the`readMSH` function while processing `MshLoader::ELEMENT_TET` elements."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE", "cweId": "CWE-125"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-05-28T14:02:40.957Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}], "credits": [{"lang": "en", "value": "Discovered by Philippe Laulheret of Cisco Talos."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24584", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T19:07:44.199738Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*"], "vendor": "libigl", "product": "libigl", "versions": [{"status": "affected", "version": "2.5.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T19:03:33.445Z"}, "title": "CISA ADP Vulnrichment"}]}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libigl:libigl:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "91BC184E-2C02-40C5-BA95-B2ADCF16C366", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.This vulnerabilitty concerns the`readMSH` function while processing `MshLoader::ELEMENT_TET` elements."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de lectura fuera de los l\u00edmites en la funcionalidad readMSH de libigl v2.5.0. Un archivo .msh especialmente manipulado puede provocar una lectura fuera de los l\u00edmites. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad. Esta vulnerabilidad afecta a la funci\u00f3n `readMSH` mientras procesa elementos `MshLoader::ELEMENT_TET`."}], "id": "CVE-2024-24584", "lastModified": "2025-02-11T22:29:21.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "talos-cna@cisco.com", "type": "Secondary"}]}, "published": "2024-05-28T14:15:11.623", "references": [{"source": "talos-cna@cisco.com", "tags": ["Technical Description", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}, {"source": "talos-cna@cisco.com", "tags": ["Technical Description", "Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Technical Description", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Technical Description", "Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1928"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}