Pixar OpenUSD Out-of-Bounds Memory Access Vulnerability (CVE-2020-9973) Analysis

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2020-9973 Vulnerability Description: A vulnerability exists in Pixar OpenUSD 20.05 when processing binary USD file offsets. A specially crafted malicious file can trigger arbitrary out-of-bounds memory access, leading to sensitive information disclosure. Affected Software Versions: - Pixar OpenUSD 20.05 - Apple macOS Catalina 10.15.3 CVSS v3 Score Score: 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CWE Classification CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Details Code Example: This code does not perform boundary checks after reading the table of contents offset from the file header, potentially leading to out-of-bounds memory access. Impact Exploitation Method: Attackers can exploit this vulnerability by providing specially crafted files, bypassing mitigations and enabling further exploitation. Testing Environment: Tested on macOS Catalina 10.15.3. Timeline 2020-07-01: Vendor notification (Pixar and Apple) 2020-07-01: Pixar confirms report 2020-07-02: Apple confirms report 2020-07-14: Talos tests latest beta of macOS Catalina 10.15.6 2020-08-04: Follow-up with Pixar, no response 2020-09-16: Second follow-up with Pixar 2020-11-12: Public disclosure Discoverer Aleksandar Nikolic of Cisco Talos

Goal Reached Thanks to every supporter — we hit 100%!

Pixar OpenUSD Out-of-Bounds Memory Access Vulnerability (CVE-2020-9973) Analysis