CVE-2021-28300
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code or cause denial-of-service by exploiting a NULL pointer dereference in GPAC's MP4 file parser. Attackers can trigger this by uploading a malicious MP4 file to systems using vulnerable GPAC versions. This affects any application or service that processes MP4 files with GPAC v0.5.2.
💻 Affected Systems
- GPAC (Multimedia Framework)
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Denial-of-service causing application crashes or service disruption when processing malicious MP4 files.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application crashes.
🎯 Exploit Status
Exploitation requires only a crafted MP4 file. The GitHub issue includes technical details that could be used to create exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.5.3 and later
Vendor Advisory: https://github.com/gpac/gpac/issues/1702
Restart Required: Yes
Instructions:
1. Download latest GPAC version from official repository. 2. Uninstall current version. 3. Install patched version. 4. Restart any services using GPAC.
🔧 Temporary Workarounds
Input Validation
allImplement strict MP4 file validation before processing with GPAC
Sandbox Processing
linuxRun GPAC in isolated container or sandbox with limited permissions
docker run --read-only --cap-drop=ALL -v /tmp:/tmp:ro gpac-container
🧯 If You Can't Patch
- Disable MP4 file upload/processing functionality in affected applications
- Implement network segmentation to isolate systems running vulnerable GPAC versions
🔍 How to Verify
Check if Vulnerable:
Check GPAC version: gpac -version. If output shows v0.5.2, system is vulnerable.Check Version:
gpac -version 2>/dev/null || gpac --version 2>/dev/null || echo "GPAC not installed"Verify Fix Applied:
After patching, verify version is v0.5.3 or later with: gpac -version📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in application logs
- GPAC process crashes
- Unexpected termination of media processing services
Network Indicators:
- Unusual MP4 file uploads to media processing endpoints
- Large number of failed MP4 processing requests
SIEM Query:
process.name:"gpac" AND event.action:"segmentation_fault" OR process.name:"gpac" AND event.outcome:"failure"