Heap Use-After-Free in GPAC MP4Box

Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) condition. A local, authenticated user can cause MP4Box to crash by processing a specially crafted media file, disrupting normal operation. There is also a possibility that the heap use-after-free could be exploited further, potentially leading to more severe consequences, although this is not confirmed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the GPAC Multimedia Open Source Project's MP4Box component, specifically in the function gf_filter_pid_inst_swap_delete_task() within filter_core/filter_pid.c. The issue is a buffer overflow caused by improper access to freed memory objects during the cleanup of PID instances after a swap or delete operation. When a local, authenticated user processes a specially crafted MPEG-2 TS or MP4 file with MP4Box, this bug can be triggered during filter teardown, leading to a heap use-after-free condition and causing the program to crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by processing specially crafted MPEG-2 TS or MP4 files with GPAC's MP4Box tool and monitoring for crashes or memory errors during PID instance cleanup.

Using debugging tools such as AddressSanitizer can help detect heap use-after-free errors by identifying invalid memory accesses during execution.

A practical approach is to run MP4Box on suspicious or malformed MPEG-2 TS files and observe if the tool crashes or reports memory corruption.

Example command to test a file for the vulnerability (replace <file.ts> with your test file):

• ASAN_OPTIONS=detect_leaks=1 mp4box -info <file.ts>

This command runs MP4Box with AddressSanitizer enabled to detect use-after-free or heap corruption issues triggered by malformed input.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update GPAC MP4Box to a version that includes the fix for this vulnerability.

The fix involves improved handling of PID instance states during discard and reconfiguration operations to prevent use-after-free conditions.

• Apply the patch from commit aed9c94e92e8ba362ddb29c767c519478f46f195 which introduces proper discard mode tracking and safer PID instance cleanup.
• Avoid processing untrusted or malformed MPEG-2 TS or MP4 files with vulnerable versions of MP4Box.

If updating immediately is not possible, restrict local user access to MP4Box or run it in a sandboxed environment to limit potential damage from exploitation.

Useful 0 Not Useful 0