CVE-2021-21845
📋 TL;DR
This vulnerability allows remote code execution through a heap-based buffer overflow in the GPAC library's MPEG-4 decoder. Attackers can exploit it by tricking users into opening malicious video files. Any application using GPAC v1.0.1 for MPEG-4 decoding is affected.
💻 Affected Systems
- GPAC Project on Advanced Content library
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary code execution as the user running the vulnerable application, potentially leading to complete system takeover.
Likely Case
Application crash (denial of service) or limited code execution within the application context, potentially leading to data theft or further system access.
If Mitigated
Application crash with no code execution if memory protections (ASLR, DEP) are effective, but denial of service still occurs.
🎯 Exploit Status
Exploitation requires user interaction to open malicious video file. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.2 and later
Vendor Advisory: https://github.com/gpac/gpac/security/advisories/GHSA-5xgg-6xr3-4cwp
Restart Required: Yes
Instructions:
1. Update GPAC to version 1.0.2 or later. 2. Rebuild any applications using GPAC with the updated library. 3. Restart affected applications.
🔧 Temporary Workarounds
Disable MPEG-4 decoding
allConfigure applications to disable MPEG-4 video processing if not required
Application sandboxing
allRun vulnerable applications in restricted environments or containers
🧯 If You Can't Patch
- Implement strict file type validation to block untrusted MPEG-4 files
- Use application allowlisting to prevent execution of vulnerable GPAC-based applications
🔍 How to Verify
Check if Vulnerable:
Check GPAC library version: gpac -version or examine linked library versions in applicationsCheck Version:
gpac -version 2>&1 | head -1Verify Fix Applied:
Confirm GPAC version is 1.0.2 or later and applications have been rebuilt with updated library📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing video files
- Memory access violation errors in application logs
Network Indicators:
- Unusual video file downloads from untrusted sources
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "access violation" OR "heap corruption") AND process="*gpac*"🔗 References
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
- https://www.debian.org/security/2021/dsa-4966
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
- https://www.debian.org/security/2021/dsa-4966
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297
