CVE-2021-32136
📋 TL;DR
This vulnerability is a heap buffer overflow in GPAC's MP4Box tool that allows attackers to cause denial of service or execute arbitrary code by providing a specially crafted MP4 file. It affects systems running GPAC 1.0.1 or earlier versions that process untrusted media files. The vulnerability resides in the print_udta function when parsing user data atoms in MP4 files.
💻 Affected Systems
- GPAC
- MP4Box
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the GPAC process, potentially leading to full system compromise if GPAC runs with elevated privileges.
Likely Case
Denial of service through application crash when processing malicious files, potentially disrupting media processing workflows.
If Mitigated
Limited impact if GPAC runs in sandboxed environments with minimal privileges and processes only trusted files.
🎯 Exploit Status
The vulnerability requires a crafted MP4 file but no authentication. Public proof-of-concept exists in GitHub issues. Heap overflow exploitation requires some skill but is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GPAC 1.0.2 and later
Vendor Advisory: https://github.com/gpac/gpac/commit/eb71812fcc10e9c5348a5d1c61bd25b6fa06eaed
Restart Required: No
Instructions:
1. Update GPAC to version 1.0.2 or later. 2. For Linux: Use package manager (apt-get update && apt-get upgrade gpac). 3. For Windows: Download latest installer from GPAC website. 4. For source: git clone and build with commit eb71812fcc10e9c5348a5d1c61bd25b6fa06eaed or later.
🔧 Temporary Workarounds
Disable MP4Box processing
linuxTemporarily disable or restrict MP4Box usage until patching is complete
chmod -x /usr/bin/MP4Box
mv /usr/bin/MP4Box /usr/bin/MP4Box.disabled
Input validation
allImplement file type validation and sanitization before processing MP4 files
🧯 If You Can't Patch
- Run GPAC in sandboxed/containerized environments with minimal privileges
- Implement strict file upload controls and only process files from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check GPAC version: MP4Box -version. If version is 1.0.1 or earlier, system is vulnerable.Check Version:
MP4Box -version 2>&1 | head -1Verify Fix Applied:
Verify GPAC version is 1.0.2 or later: MP4Box -version | grep -q '1.0.[2-9]\|2.' && echo 'Patched'📡 Detection & Monitoring
Log Indicators:
- GPAC/MP4Box segmentation faults
- Abnormal process termination when processing MP4 files
- Memory access violation errors
Network Indicators:
- Unusual MP4 file uploads to media processing services
- Large MP4 files with abnormal structure
SIEM Query:
process_name:"MP4Box" AND (event_type:"crash" OR exit_code:139 OR exit_code:-1073741819)