A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Weakness
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Autocad | Autodesk | * | 2024.1 (excluding) |
| Autocad | Autodesk | 2023.0.0 (including) | 2023.1.4 (excluding) |
| Autocad | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_advance_steel | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_advance_steel | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_architecture | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_architecture | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_civil_3d | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_civil_3d | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_electrical | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_electrical | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_lt | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_lt | Autodesk | * | 2024.1 (excluding) |
| Autocad_lt | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_map_3d | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_map_3d | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_mechanical | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_mechanical | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_mep | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_mep | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
| Autocad_plant_3d | Autodesk | * | 2023.1.4 (excluding) |
| Autocad_plant_3d | Autodesk | 2024.0.0 (including) | 2024.1.1 (excluding) |
Extended Description
An attacker can supply a pointer for memory locations that the product is not expecting. If the pointer is dereferenced for a write operation, the attack might allow modification of critical state variables, cause a crash, or execute code. If the dereferencing operation is for a read, then the attack might allow reading of sensitive data, cause a crash, or set a variable to an unexpected value (since the value will be read from an unexpected memory location). There are several variants of this weakness, including but not necessarily limited to: