CyberSecBulletin
CVE-2022-29032NVD status: Modified

JT2Go: Double Free

Published Updated By the CyberSecBulletin desk

CVE-2022-29032 is a high-severity double free vulnerability in JT2Go from Siemens, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. Affected JT2Go versions: All versions < V13.3.0.3. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.81% chance of exploitation within 30 days, higher than 58% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Teamcenter Visualization to 13.3.0.3 or 14.0.0.1, whichever matches your release line, or a later version.
  2. Read the advisory on cert-portal.siemens.com for workarounds and exact fixed builds.
  3. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensJT2GoAll versions < V13.3.0.3Not stated
SiemensTeamcenter Visualization V13.3All versions < V13.3.0.3Not stated
SiemensTeamcenter Visualization V14.0All versions < V14.0.0.1Not stated
SiemensTeamcenter Visualization13.3 up to, but not including, 13.3.0.3; 14.0 up to, but not including, 14.0.0.113.3.0.3, 14.0.0.1

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 2.06.8MediumNVD

Official description

A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library contains a double free vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Double Free

The product calls free() twice on the same memory address.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
  • Use a static analysis tool to find double free instances.

More Double Free vulnerabilities (CWE-415)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in JT2Go

All JT2Go vulnerabilities

Recent Double Free vulnerabilities

Spotted an error? Tell us.