Use After Free Vulnerability in Assimp Package - CVE-2022-45748
Summary
DEBIAN-CVE-2022-45748: An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp. Affects assimp versions < 5.3.1+ds-2. Fixed in 5.3.1+ds-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Assimp (Open Asset Import Library) is a library designed to facilitate the import and export of various 3D model formats. It provides a unified interface for developers to work with 3D assets, making it easier to integrate 3D models into applications. The library is widely used in game development, visualization, and simulation applications. However, a vulnerability has been identified in versions prior to 5.3.1+ds-2, which could lead to security risks if not addressed.
Vulnerability Detail
An issue was discovered in Assimp version 5.1.4, where a use after free vulnerability occurs in the function ColladaParser::ExtractDataObjectFromChannel located in the file /code/AssetLib/Collada/ColladaParser.cpp. This vulnerability can potentially allow an attacker to exploit the application, leading to arbitrary code execution or crashes, thereby compromising the integrity and security of the application utilizing the library.
How To Fix
Minimum fixed version
5.3.1+ds-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade assimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality in the ColladaParser until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The vulnerability CVE-2022-45748 in the Assimp package poses significant security risks due to a use after free condition. It is crucial for users to update to the patched version 5.3.1+ds-2 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for assimp →
FAQ
CVE-2022-45748 is a security vulnerability identified in the Assimp package that allows for a use after free condition, potentially leading to code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential arbitrary code execution and application crashes, which can compromise the security and stability of applications using the affected library.
Yes, a patch is available in version 5.3.1+ds-2 of the Assimp package.
If an immediate update is not possible, consider avoiding the use of the affected functionality in the ColladaParser as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for assimp.
