CVE-2021-30474

Vulnerability

The aom_dsp/grain_table.c file in libaom (the AOMedia AV1 Codec SDK) contains a use-after-free bug that was fixed before the 2021-03-30 commit 6e31957b6dc62dbc7d1bb70cd84902dd14c4bf2e [1]. Affected versions include all prior builds of libaom. The flaw occurs when the code improperly accesses memory after it has been freed, likely during operations related to film grain synthesis table handling.

Exploitation

An attacker would need to supply a specially crafted AV1 bitstream that triggers the use-after-free during decoding. No authentication or special privileges are required if the victim processes the malicious file with a vulnerable libaom version. The specific sequence involves the decoder reaching the grain table cleanup code path after freeing memory, then subsequently dereferencing the dangling pointer.

Impact

Successful exploitation could lead to arbitrary code execution, denial of service, or disclosure of memory contents [2]. The attacker could potentially achieve remote code execution on the system decoding the crafted content, with privileges equal to the process using libaom.

Mitigation

The vulnerability was fixed in the commit 6e31957b6dc62dbc7d1bb70cd84902dd14c4bf2e [1]. Users should update to libaom version 3.2.0 or later, as recommended in the Gentoo security advisory GLSA 202401-32 [2]. No known workarounds exist; updating is the only mitigation.