CVE-2023-35949

Executive Summary

CVE-2023-35949 is a critical stack-based buffer overflow vulnerability in the readOFF.cpp component of libigl v2.4.0. The flaw resides in the geometric face parsing logic of OFF file processing. An attacker can trigger arbitrary code execution by crafting a malicious .off file that overflows a stack buffer. The vulnerability has a CVSS score of 7.8 (High) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for systems that process untrusted OFF files.

Supply Chain & Package Security

libigl is a C++ geometry processing library widely used in research, computer graphics, and scientific computing. It is distributed via GitHub and package managers like vcpkg and Conan. The vulnerability affects version 2.4.0 only. No patched version has been released, making all deployments of this version vulnerable. Users should monitor the official repository for updates and consider temporary mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires the attacker to provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions needed beyond opening the file.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the malicious file.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data compromise possible.
• Integrity (I): High (H) – Arbitrary code execution allows modification.
• Availability (A): High (H) – Can crash or take over the system.

Threat Level: High – Exploitation could lead to full system compromise, but requires user interaction.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the readOFF.cpp file of libigl v2.4.0. The function responsible for parsing geometric faces from an OFF file does not properly validate the number of vertices per face or the size of the input data. When a specially crafted .off file is processed, the parser writes beyond the bounds of a fixed-size stack buffer, overwriting the return address and other critical data.

The OFF file format is a simple text-based format for storing 3D geometry. The vulnerability specifically occurs in the loop that reads face indices. If the file specifies a face with more vertices than the allocated buffer can hold, the overflow occurs. An attacker can control the overflow data to redirect execution to arbitrary shellcode.

Root Cause: Lack of bounds checking on face vertex count before copying into a stack buffer.

Vulnerable vs. Patched Code

Vulnerable Code (libigl v2.4.0, readOFF.cpp):

// Vulnerable snippet (simplified)
int numVertices;
file >> numVertices;
int indices[10]; // Fixed-size stack buffer
for (int i = 0; i < numVertices; i++) {
    file >> indices[i]; // No bounds check
}

Patched Code (Hypothetical fix):

// Patched snippet
int numVertices;
file >> numVertices;
if (numVertices > 10) {
    // Handle error or use dynamic allocation
    return false;
}
int indices[10];
for (int i = 0; i < numVertices; i++) {
    file >> indices[i];
}

No official patch exists. The fix would involve adding a bounds check or using a dynamic container like std::vector.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Ubuntu 22.04 LTS with libigl v2.4.0 compiled from source.
• Tool: Custom Python script to generate malicious OFF file.
• Payload: Simple execve("/bin/sh") shellcode.

Exploit Steps:

1. Create a malicious OFF file with a face containing more than 10 vertices.
2. The overflow overwrites the return address with a pointer to shellcode placed in the file.
3. When the victim opens the file with a libigl-based application, the shellcode executes.

Example Malicious OFF File (conceptual):

OFF
3 1 0
0.0 0.0 0.0
1.0 0.0 0.0
0.0 1.0 0.0
20 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

The face line specifies 20 vertices, causing overflow.

Blue Team (Defense)

Detection:

• Monitor for processes that open .off files with unusually large face vertex counts.
• Use stack canaries (e.g., -fstack-protector-strong) when compiling libigl.
• Deploy ASLR and NX to mitigate exploitation.

Mitigation:

• Do not open untrusted OFF files.
• Use a sandboxed environment for processing OFF files.
• Apply a local patch to add bounds checking.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – not real)
  • malicious.off: a1b2c3d4e5f6...
• Network: No network indicators unless shellcode connects outbound.
• Process: libigl_app crashing or exhibiting abnormal memory access.
• Registry/File: Unexpected .off files with face vertex counts > 10.

Detection Engineering

YARA Rule

rule CVE_2023_35949_OFF_Overflow {
    meta:
        description = "Detects malicious OFF files exploiting CVE-2023-35949"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $off_header = "OFF"
        $large_face = /^\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+/m
    condition:
        $off_header at 0 and #large_face > 0
}

Sigma Rule

title: CVE-2023-35949 OFF File Buffer Overflow Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stack buffer overflow in libigl via OFF files
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\libigl_app.exe'
        TargetFilename|endswith: '.off'
    condition: selection
falsepositives:
    - Legitimate large OFF files (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-35949 OFF File Download Attempt"; flow:to_client,established; file.name:"*.off"; file.size:>100000; content:"OFF"; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Do not open OFF files from untrusted sources.
2. Short-term: Apply a local patch to readOFF.cpp to add bounds checking on face vertex counts.
3. Long-term: Upgrade to a patched version when released. Monitor the libigl GitHub repository for updates.
4. Compensating Controls: Use stack canaries, ASLR, and NX when compiling libigl. Run libigl-based applications in a sandbox.

Valters IT
Securing Digital Frontiers