Executive Summary

This vulnerability is a flaw found in the Assimp library up to version 6.0.4, specifically in the function Assimp::glTFImporter::ImportMeshes within the glTFImporter.cpp file. The flaw causes a null pointer dereference, which means the program attempts to access memory through a pointer that is null, leading to a crash or unexpected behavior.

The vulnerability can only be exploited locally, meaning an attacker must have local access to the system to trigger it. The issue has been publicly disclosed and an exploit is available.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is limited to causing a null pointer dereference, which can lead to a denial of service by crashing the application using the vulnerable Assimp component.

Since the attack requires local access and the vulnerability does not allow for code execution or data compromise, the overall impact is low.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by triggering the null pointer dereference in the Assimp glTF importer's ImportMeshes function, typically by processing specially crafted glTF files that cause the crash.

Fuzzing the Assimp glTF importer with malformed or crafted glTF files is an effective detection method.

A proof-of-concept (PoC) exploit is available as a zip archive containing a glTF file that triggers the crash.

To detect the vulnerability on your system, you can run Assimp to import the provided PoC glTF file and observe if a crash or segmentation fault occurs.

• Download the PoC zip archive from the provided resource.
• Use a command like: assimp import ImportMeshes-segv.gltfux
• Monitor for crashes or segmentation faults during import, which indicate the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding local execution of untrusted or malformed glTF files with the vulnerable Assimp versions up to 6.0.4.

Since the vulnerability requires local execution and causes a crash via null pointer dereference, restricting access to the Assimp library or applications using it can reduce risk.

Monitor for updates or patches from the Assimp project and apply them once available.

If possible, use input validation or sandboxing techniques to limit the impact of malformed glTF files.

Useful 0 Not Useful 0