Division by Zero in FFmpeg via DOVI RPU Encoder

Executive Summary

FFmpeg through version 9.0.2 has a division by zero flaw in the dovi_configure_ext() function within libavcodec/dovi_rpuenc.c. This occurs when attackers provide a crafted HEVC or AV1 input with a zero frame rate denominator but nonzero numerator to the dovi_rpu bitstream filter or specific encoders (libx265, libaom, libsvtav1). This causes the process to crash, leading to a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for FFmpeg versions through 9.0.2 and validating inputs to dovi_rpu bitstream filter or encoders like libx265, libaom, or libsvtav1. Monitor for crashes when processing HEVC or AV1 inputs with zero frame rate denominators.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using affected FFmpeg versions to crash unexpectedly when processing malicious media files. Users may experience disruptions in video encoding or decoding tasks, leading to service unavailability or data loss if the application does not handle crashes gracefully.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing FFmpeg processes through division by zero. It does not directly impact data confidentiality or integrity required by standards like GDPR or HIPAA. However, service disruption could indirectly affect compliance if systems fail to process or secure data during outages.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FFmpeg to a version beyond 9.0.2. Validate frame rate inputs to prevent division by zero. Disable or restrict access to dovi_rpu bitstream filter and affected encoders until patched.

Useful 0 Not Useful 0