Heap Use-After-Free in FFmpeg MJPEG Decoder

Executive Summary

This vulnerability is a use-after-free issue in FFmpeg through version 9.0.2. It occurs in the libavcodec/mjpegdec.c component when processing MJPEG streams. Attackers can exploit it by sending a crafted stream with a SOF marker without a preceding SOI marker. This causes the function ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hardware accelerators like NVDEC, leading to crashes or heap content leaks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor FFmpeg applications for crashes when processing MJPEG streams. Check logs for errors related to libavcodec/mjpegdec.c or hardware-accelerated decoders like NVDEC. Use network traffic analysis tools to inspect for malformed MJPEG streams with SOF markers lacking preceding SOI markers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact users by causing applications to crash when processing malicious MJPEG streams. It may also lead to information disclosure if heap memory contents are leaked. Attackers could exploit this to execute arbitrary code or gain unauthorized access to sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to memory contents through heap leaks or application crashes. Exploitation may lead to exposure of sensitive data processed by affected applications, violating confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update FFmpeg to version 9.0.3 or later to address the use after free vulnerability in libavcodec/mjpegdec.c.

Useful 0 Not Useful 0