CVE-2021-21859
📋 TL;DR
An integer truncation vulnerability in GPAC's MPEG-4 decoder allows memory corruption when processing specially crafted video files. Attackers can exploit this by tricking users into opening malicious videos, potentially leading to arbitrary code execution. This affects applications using the GPAC library for video processing.
💻 Affected Systems
- GPAC Project on Advanced Content library
- Applications using GPAC for MPEG-4 decoding
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using GPAC library, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited code execution depending on exploit sophistication and memory protections.
If Mitigated
Application crash with no code execution if ASLR/DEP/other mitigations are effective.
🎯 Exploit Status
Exploit requires crafting malicious MPEG-4 video file and convincing user to open it. Proof-of-concept available in Talos advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.2 or later
Vendor Advisory: https://github.com/gpac/gpac/security/advisories
Restart Required: Yes
Instructions:
1. Update GPAC library to v1.0.2 or later. 2. Rebuild applications using GPAC. 3. Restart affected applications/services.
🔧 Temporary Workarounds
Disable MPEG-4 processing
allConfigure applications to disable MPEG-4 video processing if not required
Sandbox media processing
linuxRun media processing applications in restricted containers/sandboxes
docker run --security-opt=no-new-privileges --read-only -v /tmp:/tmp:rw media_app
🧯 If You Can't Patch
- Implement strict input validation for video files from untrusted sources
- Use application allowlisting to prevent execution of unauthorized media processing tools
🔍 How to Verify
Check if Vulnerable:
Check GPAC library version: gpac -version or check linked library version in applicationsCheck Version:
gpac -version 2>/dev/null | head -1Verify Fix Applied:
Confirm GPAC version is 1.0.2 or higher and applications have been rebuilt with updated library📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing video files
- Memory access violation errors in application logs
Network Indicators:
- Unusual video file downloads from untrusted sources
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "access violation") AND process="*gpac*"