NULL Pointer Dereference in Open Asset Import Library

Executive Summary

This vulnerability is a NULL pointer dereference flaw in the Open Asset Import Library (assimp) version 6.0.5 or earlier. It occurs in the Ogre3D binary mesh importer when processing animation track targets. Attackers can exploit this by providing a specially crafted .mesh file with a morph animation track that references a missing submesh or absent shared geometry, causing the host application to crash.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect files processed by assimp for malformed .mesh files, particularly those with morph animation tracks targeting missing submeshes or absent shared geometry. Check for crashes in applications using assimp when loading such files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing applications that use the affected assimp library. If exploited, it may lead to application instability or termination when processing malicious .mesh files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service via application crashes, which may impact availability of systems processing untrusted mesh files. For GDPR, availability is a key principle, so repeated crashes could affect compliance if they disrupt processing of personal data. HIPAA requires integrity and availability of protected health information; crashes could risk data access during critical operations.

Useful 0 Not Useful 0

Mitigation Strategies

Update assimp to the latest patched version beyond 6.0.5 to address the NULL pointer dereference and potential buffer overflow issues. Avoid processing untrusted .mesh files until the update is applied.

Useful 0 Not Useful 0