CVE-2024-23950

Executive Summary

CVE-2024-23950 is a critical out-of-bounds write vulnerability in the libigl library, version 2.5.0, specifically within the igl::MshLoader::parse_element_field function. The flaw arises from improper array index validation when parsing specially crafted .msh files in binary format. An attacker can exploit this by providing a malicious .msh file, leading to arbitrary memory corruption. The CVSS score is 8.8 (High), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is currently available.

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby) and is a standalone C++ library issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Local (AV:L) – requires the victim to open a malicious file.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must open the file.
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although no active exploitation is reported, the vulnerability allows full memory corruption, potentially leading to code execution.

Deep Dive & Mechanics

The vulnerability resides in the igl::MshLoader::parse_element_field function within libigl v2.5.0. This function is responsible for parsing element fields from binary .msh files (GMSH format). The flaw is due to improper validation of array indices when reading data from the file. An attacker can craft a .msh file with manipulated header fields (e.g., number of elements, element types, or data sizes) that cause the parser to write data beyond the allocated buffer.

The out-of-bounds write occurs because the code does not check whether the index used to access an array is within bounds before writing. This can corrupt adjacent memory, potentially overwriting function pointers, return addresses, or other critical data structures.

Root Cause: Missing bounds check on array index before write operation in parse_element_field.

Vulnerable vs. Patched Code

Vulnerable Code (libigl v2.5.0):

// In MshLoader.cpp
bool MshLoader::parse_element_field(std::ifstream &in, int num_elements, int num_fields) {
    // ...
    for (int i = 0; i < num_elements; i++) {
        for (int j = 0; j < num_fields; j++) {
            double val;
            in.read((char*)&val, sizeof(double));
            // VULNERABLE: No bounds check on element_data[i][j]
            element_data[i][j] = val;
        }
    }
    // ...
}

Patched Code (Hypothetical fix):

bool MshLoader::parse_element_field(std::ifstream &in, int num_elements, int num_fields) {
    // ...
    if (num_elements > element_data.size() || num_fields > element_data[0].size()) {
        return false; // Bounds check added
    }
    for (int i = 0; i < num_elements; i++) {
        for (int j = 0; j < num_fields; j++) {
            double val;
            in.read((char*)&val, sizeof(double));
            element_data[i][j] = val;
        }
    }
    // ...
}

Note: No official patch is available yet. The above is a conceptual fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• libigl v2.5.0 installed.
• A victim application that uses MshLoader to load .msh files.

Exploitation Steps:

1. Craft a malicious binary .msh file with manipulated header fields (e.g., set num_elements to a large value, or num_fields to exceed allocated size).
2. Deliver the file to the victim via email, download, or other means.
3. When the victim opens the file with an application using libigl, the out-of-bounds write occurs, potentially corrupting memory.
4. If the attacker can control the written data (e.g., by embedding shellcode or ROP chain), code execution may be achieved.

No public exploit code is available.

Blue Team

Detection:

• Monitor for processes that open .msh files and exhibit abnormal memory access patterns.
• Use memory corruption detection tools (e.g., AddressSanitizer) during development.
• Implement file validation before parsing (e.g., check file size, element counts).

Hunting:

• Search for crashes or segmentation faults in applications using libigl.
• Look for .msh files with unusually large element counts or field sizes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): None available (no known malicious samples).
• Network Indicators: None (local file-based attack).
• Behavioral: Application crash when opening a .msh file; memory corruption errors in logs.
• Registry/File System: Presence of .msh files with anomalous headers (e.g., $ElementType or $ElementData sections with unrealistic sizes).

Detection Engineering

YARA Rule

rule CVE_2024_23950_libigl_msh {
    meta:
        description = "Detects malicious .msh files targeting libigl CVE-2024-23950"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23950"
    strings:
        $header = "$MeshFormat" ascii wide nocase
        $binary_flag = "1" ascii wide nocase
        $element_section = "$Elements" ascii wide nocase
    condition:
        $header at 0 and $binary_flag and $element_section
}

Sigma Rule

title: CVE-2024-23950 - libigl MSH File Parsing Out-of-Bounds Write
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2024-23950 via malicious .msh files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\app.exe'  # Replace with actual application name
        CommandLine|contains: '.msh'
    condition: selection
falsepositives:
    - Legitimate use of .msh files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23950 - libigl MSH File Download"; flow:to_client,established; file.name:"*.msh"; file.size:>100000; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not open untrusted .msh files with applications using libigl v2.5.0.
2. Monitor for updates from the libigl project (https://github.com/libigl/libigl).
3. Apply input validation on file headers before parsing (e.g., check element counts against allocated buffer sizes).

Long-term Fix:

• Upgrade to a patched version once released.
• Implement bounds checking in parse_element_field and similar functions.

Workaround:

• Use a different mesh library or file format until a patch is available.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert