Out-of-Bounds Read in VideoLAN libbluray

Executive Summary

VideoLAN libbluray through version 1.5.1 has an out-of-bounds read vulnerability in the clpi_access_point() function. Attackers can exploit this by providing a malicious ClipInfo file with an empty EP-map fine table. Specifically, setting num_ep_fine to zero and using an unclamped ref_ep_fine_id allows reading out-of-bounds memory during seeking operations, which can crash applications.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using libbluray for malformed .clpi files in BDMV/CLIPINF directories. Check for files with num_ep_fine set to zero and unclamped ref_ep_fine_id values. Use file analysis tools to examine ClipInfo files for these anomalies.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libbluray to crash when processing a specially crafted .clpi file. If an attacker places this file in the BDMV/CLIPINF directory of a Blu-ray disc or similar media, it could lead to denial-of-service conditions for users trying to play the disc.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes application crashes due to out-of-bounds reads, which may lead to denial-of-service conditions. It does not directly impact data confidentiality, integrity, or privacy controls required by standards like GDPR or HIPAA. However, if exploited in systems processing sensitive data, it could indirectly affect availability, potentially violating service-level agreements or operational requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update libbluray to the latest version beyond 1.5.1. Remove or quarantine any suspicious .clpi files in BDMV/CLIPINF directories. Monitor applications using libbluray for crashes during media playback or seeking operations.

Useful 0 Not Useful 0