Heap Out-of-Bounds Read in Assimp glTF Parser

Executive Summary

This vulnerability is a heap out-of-bounds read in the Assimp library (versions up to 6.0.6) during glTF file parsing. It occurs in the ParseDataURI function where a signed char stores a data offset. Attackers can craft a glTF file with a raw data URI segment starting beyond byte 127, causing the offset to wrap around to a negative value. This leads to invalid pointer calculations, application crashes, or leakage of adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect glTF files processed by Assimp for malformed data URIs with offsets exceeding 127 bytes. Use tools like file integrity checkers or custom scripts to validate glTF files before processing. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you process untrusted glTF files using Assimp 6.0.6 or earlier, this flaw could crash your application or expose sensitive memory contents. Attackers might exploit it by providing specially crafted files, potentially leading to denial of service or information disclosure. Systems handling glTF files from untrusted sources are most at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by enabling information disclosure (e.g., memory leaks) if exploited. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit might expose sensitive data, violating these regulations. Organizations must ensure patched Assimp versions are used to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

• Update Assimp to a patched version where offsets are stored as unsigned types and validated against URI length.
• Reject or sanitize glTF files with data URIs containing offsets beyond 127 bytes.
• Monitor applications using Assimp for crashes or memory leaks when processing glTF files.

Useful 0 Not Useful 0