CVE-2021-30145
📋 TL;DR
A format string vulnerability in mpv media player allows attackers to execute arbitrary code by tricking users into opening a malicious m3u playlist file. This affects mpv versions up to 0.33.0 on all platforms where users open untrusted playlist files.
💻 Affected Systems
- mpv media player
📦 What is this software?
Mpv by Mpv
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the mpv user, potentially leading to full system compromise, data theft, or malware installation.
Likely Case
Local privilege escalation or arbitrary code execution when users open malicious playlist files from untrusted sources.
If Mitigated
Limited impact if users only open trusted playlist files and mpv runs with minimal privileges.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious playlist file. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.33.1 and later
Vendor Advisory: https://github.com/mpv-player/mpv/releases/tag/v0.33.1
Restart Required: No
Instructions:
1. Download mpv 0.33.1 or later from https://mpv.io/installation/ 2. Install the updated version 3. Verify installation with 'mpv --version'
🔧 Temporary Workarounds
Disable playlist file association
allRemove mpv as the default application for .m3u files to prevent automatic opening
Run mpv with reduced privileges
linuxExecute mpv with limited user permissions to reduce impact of exploitation
sudo -u nobody mpv [file]
🧯 If You Can't Patch
- Avoid opening m3u playlist files from untrusted sources
- Use alternative media players for playlist files until patched
🔍 How to Verify
Check if Vulnerable:
Check mpv version with 'mpv --version' and verify it's 0.33.0 or earlierCheck Version:
mpv --version | head -1Verify Fix Applied:
Confirm mpv version is 0.33.1 or later with 'mpv --version'📡 Detection & Monitoring
Log Indicators:
- Unusual mpv process behavior
- Unexpected child processes spawned from mpv
- Crash logs from mpv with format string errors
Network Indicators:
- Downloads of m3u files from suspicious sources
- Outbound connections from mpv process
SIEM Query:
process_name="mpv" AND (process_command_line CONTAINS ".m3u" OR file_path ENDS WITH ".m3u")🔗 References
- https://devel0pment.de/?p=2217
- https://github.com/mpv-player/mpv/commit/d0c530919d8cd4d7a774e38ab064e0fabdae34e6
- https://github.com/mpv-player/mpv/releases/tag/v0.33.1
- https://mpv.io
- https://security.gentoo.org/glsa/202107-46
- https://devel0pment.de/?p=2217
- https://github.com/mpv-player/mpv/commit/d0c530919d8cd4d7a774e38ab064e0fabdae34e6
- https://github.com/mpv-player/mpv/releases/tag/v0.33.1
- https://mpv.io
- https://security.gentoo.org/glsa/202107-46
