CVE-2023-38857

Vulnerability

A heap-buffer-overflow vulnerability exists in faad2 version 2.10.1 within the stcoin function in mp4read.c at line 449:63 [1]. The overflow occurs when parsing a crafted MP4 file; the stcoin function reads 4 bytes from a heap-allocated buffer that is only 8 bytes in size, resulting in a read beyond the allocated region [1]. The buffer is allocated by the stscin function during earlier parsing [1]. This vulnerability affects all versions prior to 2.11.0 [2].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted MP4 file to the faad2 decoder [1]. No authentication or special privileges are required; the attack can be performed remotely by enticing a user to process the malicious file. The parsing process triggers the overflow in the stcoin function during the handling of the MP4 atom structure, as demonstrated by the AddressSanitizer trace [1].

Impact

Successful exploitation allows a remote attacker to cause a heap-buffer-overflow, potentially leading to arbitrary code execution or a denial of service [1][2]. The vulnerability is classified as a buffer overflow with high severity, as it can compromise the confidentiality, integrity, and availability of the affected system.

Mitigation

The vulnerability is fixed in faad2 version 2.11.0 [2]. Users should upgrade to this version or later. There is no known workaround for this issue [2]. The Gentoo security advisory (GLSA 202401-13) recommends updating the media-libs/faad2 package to version 2.11.0 or higher [2].