PT-2022-13892 · Gpac · Gpac

Xidoo123 · Published 2022-04-25 · Updated 2023-06-27 · CVE-2022-1441

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPAC versions 2.0.0

Description The issue arises when MP4Box, a component of GPAC, attempts to parse a MP4 file. It calls the function diST box read() to read from the video, allocating a buffer str with a fixed length. However, the content read from bs and its length are controllable by the user, leading to a buffer overflow.

Recommendations For GPAC version 2.0.0, consider disabling the diST box read() function as a temporary workaround until a patch is available. Restrict access to MP4Box to minimize the risk of exploitation. Avoid using MP4Box to parse MP4 files from untrusted sources until the issue is resolved.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2022-1441

DSA-5411-1

Affected Products

Gpac

References · 12

• 🔥 https://github.com/gpac/gpac/issues/2175 · Exploit
• https://github.com/gpac/gpac/commit/3dbe11b37d65c8472faf0654410068e5500b3adb · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-1441 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1441 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1441 · Vendor Advisory
• https://debian.org/security/2023/dsa-5411 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5411-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-1441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1441 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-1441 · Security Note
• https://ubuntu.com/security/CVE-2022-1441 · Vendor Advisory
• https://t.me/cibsecurity/41396 · Telegram Post