Heap Memory Leak in FFmpeg PCX Decoder

Executive Summary

This vulnerability in FFmpeg versions 2.1 through 9.0.2 involves a use of uninitialized resource in the PCX decoder. Attackers can craft a PCX image with truncated RLE scanlines, causing the pcx_decode_frame() function to copy uninitialized heap memory into decoded pixels, leaking sensitive data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect FFmpeg versions 2.1 through 9.0.2 for PCX file processing. Check if FFmpeg is linked against vulnerable libavcodec versions. Use commands like 'ffmpeg -version' to verify the version and 'ldd $(which ffmpeg) | grep avcodec' to check linked libraries.

Useful 0 Not Useful 0

Impact Analysis

This flaw could allow attackers to leak sensitive memory contents through crafted PCX images. While it does not directly enable code execution or privilege escalation, it may expose confidential information processed by FFmpeg, potentially leading to secondary attacks or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data processed by FFmpeg, such as personal or health information. GDPR requires protection of personal data, and HIPAA mandates safeguards for health information. A memory leak could violate these regulations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FFmpeg to a version beyond 9.0.2 where the vulnerability is patched. If updating is not possible, avoid processing untrusted PCX files until the update is applied. Monitor for suspicious memory leaks or crashes during PCX decoding.

Useful 0 Not Useful 0