Heap Out-of-Bounds Write in libLAS Point Record Reader

Executive Summary

libLAS through 1.8.1 has a heap out-of-bounds write flaw in its point record reader. The issue occurs when the schema byte size is truncated to 16 bits for buffer allocation, but the actual schema size exceeds 65,535 bytes. Attackers exploit this by crafting a .las file with a LASSchema variable-length record that forces tools like lasinfo or las2las to write beyond the allocated heap buffer, causing memory corruption and crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect libLAS versions on your system. Use commands like 'lasinfo --version' or 'ldd $(which lasinfo) | grep libLAS' to check installed versions. If using version 1.8.1 or earlier, the system is vulnerable. Additionally, monitor for crashes when processing LAS files with tools like lasinfo, las2las, or las2txt.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to crashes or arbitrary code execution if you process untrusted .las files with vulnerable libLAS versions. Tools like lasinfo, las2las, or las2txt are affected by default, meaning any program using libLAS to read LAS files could be compromised. Memory corruption may allow attackers to gain control over your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a memory corruption issue in libLAS that could lead to crashes or arbitrary code execution when processing malformed LAS files. Compliance impacts would only occur if the vulnerability were exploited to access, modify, or destroy sensitive data processed by affected systems, which is not described in the provided context.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade libLAS to a patched version beyond 1.8.1. Avoid processing untrusted LAS files until patched. If upgrading is not possible, disable tools like lasinfo, las2las, and las2txt or restrict their use to trusted files only.

Useful 0 Not Useful 0