CVE-2021-21849
📋 TL;DR
An integer overflow vulnerability in GPAC's MPEG-4 decoder allows heap-based buffer overflow via specially crafted video files. Attackers can exploit this by tricking users into opening malicious videos, potentially leading to remote code execution. This affects applications using GPAC library v1.0.1 for video processing.
💻 Affected Systems
- GPAC Project on Advanced Content library
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using GPAC, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
Application crash without code execution if memory protections (ASLR, DEP) are effective.
🎯 Exploit Status
Exploitation requires user interaction to open malicious video file. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.2 or later
Vendor Advisory: https://github.com/gpac/gpac/security/advisories/GHSA-5x5h-9q6c-2h4q
Restart Required: Yes
Instructions:
1. Update GPAC library to v1.0.2 or later. 2. Rebuild any applications using GPAC. 3. Restart affected services.
🔧 Temporary Workarounds
Disable MPEG-4 decoding
allConfigure applications to disable MPEG-4 video processing if not required.
Input validation
allImplement strict file type validation before processing video files.
🧯 If You Can't Patch
- Implement application sandboxing to limit potential damage from exploitation
- Use memory protection mechanisms (ASLR, DEP) and monitor for crash reports
🔍 How to Verify
Check if Vulnerable:
Check GPAC library version: gpac -version or examine linked library version in applications.Check Version:
gpac -version 2>&1 | head -1Verify Fix Applied:
Verify GPAC version is v1.0.2 or later and test with known malicious MPEG-4 samples.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing video files
- Memory access violation errors in application logs
Network Indicators:
- Unusual video file downloads to systems running GPAC
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "access violation") AND process="*gpac*"