NULL Pointer Dereference in GPAC MP4Box via Crafted MP4 File

Executive Summary

This vulnerability is a NULL pointer dereference in the function gf_isom_copy_sample_info within the isomedia/isom_write.c file of GPAC MP4Box version 2.4. It occurs when the software processes a specially crafted MP4 file, leading to a crash or Denial of Service (DoS) condition.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability by providing a maliciously crafted MP4 file to the affected software, causing it to crash or become unavailable. This results in a Denial of Service (DoS), potentially disrupting normal operations or services that rely on GPAC MP4Box.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability described is a NULL pointer dereference leading to a Denial of Service (DoS) in GPAC MP4Box. It does not involve unauthorized access, data leakage, or modification of data.

Since the vulnerability impacts availability but does not affect confidentiality or integrity, its direct impact on compliance with standards like GDPR or HIPAA—which primarily focus on protecting personal data confidentiality and integrity—is limited.

However, availability is also a component of some regulations, so a DoS could potentially affect compliance if it disrupts critical services handling regulated data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to process crafted MP4 files that contain corrupted Sample Auxiliary Information (SAI) metadata, such as an invalid sai_samples count, using the vulnerable GPAC MP4Box versions prior to the fix commit f87b30611380e4dcd03cd4dd9ac553c0ec336826.

A practical detection method is to use a proof-of-concept (PoC) crafted MP4 file to trigger the NULL pointer dereference and observe if the MP4Box process crashes with a segmentation fault.

While specific commands are not provided, a general approach would be to run MP4Box on suspicious or untrusted MP4 files and monitor for crashes or segmentation faults, for example:

• mp4box -add suspicious_file.mp4 output.mp4
• Monitor the process for crashes or segmentation faults during this operation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should update GPAC MP4Box to a version that includes the fix commit f87b30611380e4dcd03cd4dd9ac553c0ec336826 or later.

Until an update is applied, avoid processing untrusted or crafted MP4 files that could exploit the NULL pointer dereference vulnerability.

Additionally, monitor your systems for crashes related to MP4Box and restrict access to the MP4Box utility to trusted users only.

Useful 0 Not Useful 0