Heap Overflow in GPAC via gf_route_media_complete_object

Executive Summary

This vulnerability is a format string issue in the GPAC multimedia framework affecting the gf_route_dmx_push_object function. It occurs when a user-controlled format string from an FDT-Instance XML element's fileTemplate attribute is passed to sprintf without proper sanitization. Attackers can inject malicious format specifiers like %n to trigger arbitrary memory writes, potentially causing crashes or code execution depending on system hardening.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC applications, particularly those handling ROUTE/DASH streams. Check for segmentation faults or memory corruption errors in logs. Use AddressSanitizer (ASAN) during compilation to detect invalid memory writes. Inspect network traffic for malformed UDP packets targeting ROUTE STSID descriptors with crafted fileTemplate attributes containing format string specifiers like %n.

Useful 0 Not Useful 0

Impact Analysis

The primary impact is denial of service through application crashes. In some configurations, it could allow arbitrary code execution. Attackers can trigger this by sending specially crafted UDP packets to vulnerable systems using GPAC's ROUTE protocol.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability primarily causes denial of service by triggering memory corruption through a format string issue. This could lead to crashes or potential arbitrary code execution depending on system hardening. For compliance like GDPR or HIPAA, such disruptions could impact data availability and integrity, potentially violating requirements for secure processing and access to sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to the fixed version 3c4e6c5b3e0c6fa9b16d55599701a08354538fab or later to address the memory management issue in route_dmx.c.

Useful 0 Not Useful 0