CVE-2021-30473

Vulnerability

The vulnerability resides in aom_image.c of the libaom library (AOMedia's AV1 codec SDK) prior to commit 4efe20e99dcd9b6f8eadc8de8acc825be7416578 (2021-04-07). The code frees memory that is not located on the heap, which constitutes a memory corruption bug. All versions before this commit are affected [1].

Exploitation

An attacker can exploit this by crafting a malicious AV1 bitstream that triggers the erroneous free operation. The victim must decode the crafted stream using a vulnerable version of libaom. No authentication is required if the decoder processes user-supplied data, making the attack remotely exploitable in scenarios where untrusted media is decoded.

Impact

Successful exploitation can lead to heap corruption, which may allow an attacker to achieve arbitrary code execution or cause a denial of service. The Gentoo security advisory (GLSA 202401-32) lists remote code execution as a possible outcome among the vulnerabilities addressed [3].

Mitigation

The issue is fixed in commit 4efe20e99dcd9b6f8eadc8de8acc825be7416578 (2021-04-07) [1]. Users should upgrade to libaom version 3.2.0 or later, as recommended by the Gentoo advisory [3]. No workaround is available.