autocad 安全漏洞 (CVE-2023-25003)

CVE编号

CVE-2023-25003

利用情况

暂无

补丁情况

N/A

披露时间

2023-06-24

漏洞描述

A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnerabilities. Exploitation of this vulnerability may lead to code execution.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	autodesk	alias	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_advance_steel	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_advance_steel	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad_advance_steel	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad_advance_steel	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_architecture	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_architecture	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad_architecture	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad_architecture	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_civil_3d	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_civil_3d	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad_civil_3d	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad_civil_3d	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_electrical	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_electrical	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad_electrical	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad_electrical	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_lt	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_lt	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad_lt	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad_lt	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_map_3d	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_map_3d	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
	应用	autodesk	autocad_map_3d	*	From (including) 2022	Up to (excluding) 2022.1.3
	运行在以下环境
	应用	autodesk	autocad_map_3d	*	From (including) 2023	Up to (excluding) 2023.1.1
	运行在以下环境
	应用	autodesk	autocad_mechanical	*	From (including) 2020	Up to (excluding) 2020.1.6
	运行在以下环境
	应用	autodesk	autocad_mechanical	*	From (including) 2021	Up to (excluding) 2021.1.3
	运行在以下环境
应用	autodesk	autocad_mechanical	*	From (including) 2022	Up to (excluding) 2022.1.3
运行在以下环境
应用	autodesk	autocad_mechanical	*	From (including) 2023	Up to (excluding) 2023.1.1
运行在以下环境
应用	autodesk	autocad_mep	*	From (including) 2020	Up to (excluding) 2020.1.6
运行在以下环境
应用	autodesk	autocad_mep	*	From (including) 2021	Up to (excluding) 2021.1.3
运行在以下环境
应用	autodesk	autocad_mep	*	From (including) 2022	Up to (excluding) 2022.1.3
运行在以下环境
应用	autodesk	autocad_mep	*	From (including) 2023	Up to (excluding) 2023.1.1
运行在以下环境
应用	autodesk	autocad_plant_3d	*	From (including) 2020	Up to (excluding) 2020.1.6
运行在以下环境
应用	autodesk	autocad_plant_3d	*	From (including) 2021	Up to (excluding) 2021.1.3
运行在以下环境
应用	autodesk	autocad_plant_3d	*	From (including) 2022	Up to (excluding) 2022.1.3
运行在以下环境
应用	autodesk	autocad_plant_3d	*	From (including) 2023	Up to (excluding) 2023.1.1
运行在以下环境
应用	autodesk	infraworks	*	From (including) 2021	Up to (excluding) 2021.2
运行在以下环境
应用	autodesk	infraworks	*	From (including) 2022	Up to (excluding) 2022.1
运行在以下环境
应用	autodesk	infraworks	*	From (including) 2023	Up to (excluding) 2023.1
运行在以下环境
应用	autodesk	inventor	*	From (including) 2021	Up to (excluding) 2021.5
运行在以下环境
应用	autodesk	inventor	*	From (including) 2022	Up to (excluding) 2022.4
运行在以下环境
应用	autodesk	inventor	*	From (including) 2023	Up to (excluding) 2023.3.1
运行在以下环境
应用	autodesk	maya_usd	*	From (including) 2022	Up to (excluding) 2022.5
运行在以下环境
应用	autodesk	maya_usd	*	From (including) 2023	Up to (excluding) 2023.3
运行在以下环境
应用	autodesk	navisworks	*	From (including) 2022	Up to (excluding) 2022.4
运行在以下环境
应用	autodesk	navisworks	*	From (including) 2023	Up to (excluding) 2023.2
运行在以下环境
应用	autodesk	revit	*	From (including) 2021	Up to (excluding) 2021.1.8
运行在以下环境
应用	autodesk	vred	*	From (including) 2023	Up to (excluding) 2023.4

CVSS3评分 7.8

• 攻击路径 本地
• 攻击复杂度 低
• 权限要求 无
• 影响范围 未更改
• 用户交互 需要
• 可用性 高
• 保密性 高
• 完整性 高

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-ID	漏洞类型
CWE-125	跨界内存读
CWE-787	跨界内存写

Exp相关链接

- avd.aliyun.com