CVE-2024-24583

Executive Summary

CVE-2024-24583 is a medium-severity vulnerability in the libigl library (v2.5.0), specifically within the readMSH function. The flaw is an out-of-bounds read that occurs when processing specially crafted .msh files containing MshLoader::ELEMENT_TRI elements. An attacker can exploit this by providing a malicious mesh file, leading to potential information disclosure or application instability. The vulnerability has a CVSS score of 4.3, indicating a moderate risk, and currently no patch is publicly available. The EPSS score is 0.0%, suggesting low exploitation activity in the wild.

Supply Chain & Package Security

libigl is a C++ geometry processing library widely used in research and industry. This vulnerability affects the library's core mesh loading functionality, which is a critical component for any application that imports .msh files. Since libigl is often integrated as a dependency in larger projects, this flaw could propagate through the supply chain. Users are advised to audit their dependencies and consider alternative mesh loading methods until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
• Attack Vector: Local (requires user interaction to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low (potential memory read)
• Integrity Impact: None
• Availability Impact: Low (potential crash)

The threat level is moderate. Exploitation requires the victim to open a malicious .msh file, limiting remote attack vectors. However, the lack of a patch increases the risk for applications that process untrusted mesh files.

Deep Dive & Mechanics

The vulnerability resides in the readMSH function of libigl v2.5.0, specifically when handling MshLoader::ELEMENT_TRI elements. The .msh file format is a GMSH mesh format that contains element connectivity data. The readMSH function reads element data into arrays without proper bounds checking, leading to an out-of-bounds read when the file specifies element indices that exceed the allocated buffer size.

The root cause is insufficient validation of the number of elements or the indices within the ELEMENT_TRI section. An attacker can craft a .msh file with a large number of triangle elements or invalid node indices, causing the function to read beyond the allocated memory. This can leak sensitive data or cause a segmentation fault.

Vulnerable vs. Patched Code

Vulnerable Code (libigl v2.5.0):

// In readMSH.cpp
std::vector<int> tri_elements;
// ... parsing code ...
for (int i = 0; i < num_tri_elements; ++i) {
    int node_idx;
    file >> node_idx;
    tri_elements.push_back(node_idx); // No bounds check on node_idx
}

Patched Code (hypothetical):

// In readMSH.cpp
std::vector<int> tri_elements;
// ... parsing code ...
for (int i = 0; i < num_tri_elements; ++i) {
    int node_idx;
    file >> node_idx;
    if (node_idx < 0 || node_idx >= max_node_index) {
        // Handle error or skip invalid element
        continue;
    }
    tri_elements.push_back(node_idx);
}

The patch would add validation to ensure node_idx is within the valid range of node indices, preventing out-of-bounds reads.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would craft a malicious .msh file with an oversized ELEMENT_TRI section or invalid node indices. The following is a conceptual example of a malformed .msh file:

$MeshFormat
2.2 0 8
$EndMeshFormat
$Nodes
3
1 0.0 0.0 0.0
2 1.0 0.0 0.0
3 0.0 1.0 0.0
$EndNodes
$Elements
1
1 2 2 0 1 2 3
$EndElements
$Elements
1000000
1 2 2 0 1 2 3
...
$EndElements

The attacker would then deliver this file via phishing or other social engineering, tricking the user into opening it with an application that uses libigl.

Blue Team

To detect exploitation attempts, monitor for abnormal .msh file sizes or unusual element counts. Use the following detection rules:

• File Integrity Monitoring: Alert on .msh files with element counts exceeding a threshold (e.g., > 10,000).
• Application Logs: Monitor for crashes or segmentation faults in applications using libigl.
• Network Traffic: If files are transferred over the network, inspect for malformed .msh headers.

Indicators of Compromise (IOCs)

• File Hashes: (None available, but monitor for .msh files with unusual structure)
• Network Indicators: (None specific)
• Behavioral Indicators:
  • Application crashes when processing .msh files.
  • Unexpected memory reads or segmentation faults in libigl-based software.
  • Unusually large .msh files (e.g., > 100 MB) with few actual nodes.

Detection Engineering

YARA Rule

rule CVE_2024_24583_libigl_msh_oob_read {
    meta:
        description = "Detects malicious .msh files targeting libigl CVE-2024-24583"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24583"
    strings:
        $mesh_format = "$MeshFormat"
        $elements = "$Elements"
        $tri_element = "2 2" // Triangle element type in GMSH format
    condition:
        $mesh_format at 0 and #elements > 1 and #tri_element > 10000
}

Sigma Rule

title: CVE-2024-24583 - libigl MSH Out-of-Bounds Read
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-24583 via malformed .msh files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\libigl.dll'
        TargetFilename|endswith: '.msh'
    condition: selection
falsepositives:
    - Legitimate large mesh files
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-24583 - libigl MSH Out-of-Bounds Read"; flow:to_client,established; content:"$MeshFormat"; content:"$Elements"; content:"2 2"; within:100; threshold:type limit, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: No official patch is available. Monitor the libigl GitHub repository for updates.
2. Mitigation:
   • Avoid processing untrusted .msh files.
   • Implement input validation in applications using libigl to reject files with excessive element counts.
   • Use a sandbox or containerized environment for processing mesh files.
   • Consider using alternative mesh loading libraries until a fix is released.
3. Workaround: Modify the readMSH function to add bounds checking on element indices (as shown in the patched code example).

Valters IT