Out-of-Bounds Read in Schroedinger libschroedinger

Executive Summary

This is an out-of-bounds read vulnerability in the Schroedinger libschroedinger library through version 1.0.11. Attackers can exploit it by supplying unvalidated wavelet filter index or transform depth values in a crafted low-delay Dirac stream. This causes the decoder to read past a static quantiser table, potentially crashing the application.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the presence of vulnerable Schroedinger library versions (1.0.11 or earlier) on your system. Use commands like 'dpkg -l | grep schroedinger' on Debian-based systems or 'rpm -qa | grep schroedinger' on RPM-based systems to check installed versions. Inspect application logs for crashes when processing Dirac video streams, particularly those with wavelet filter indices of 7+ or transform depths of 5-6.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause decoding applications to crash when processing malicious video streams. Since it involves memory corruption, it may also allow arbitrary code execution or denial of service in vulnerable systems using the Schroedinger library.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes application crashes due to out-of-bounds memory reads, which does not directly impact data confidentiality or integrity required by standards like GDPR or HIPAA. However, repeated crashes could lead to denial-of-service scenarios affecting system availability, potentially violating service level agreements or operational requirements in regulated environments.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Schroedinger to a patched version if available. Since the project is abandoned, consider replacing it with a maintained alternative like FFmpeg.
• Disable Dirac video decoding in applications using Schroedinger until a fix is applied.
• Implement input validation for wavelet filter indices and transform depths in applications processing Dirac streams.
• Monitor system logs for crashes in video decoding applications, especially those handling low-delay Dirac streams.

Useful 0 Not Useful 0