CVE-2021-32273
📋 TL;DR
CVE-2021-32273 is a stack buffer overflow vulnerability in the ftypin function of faad2 MP4/AAC audio decoder library. It allows remote attackers to execute arbitrary code by providing specially crafted MP4 files. Any application or system using vulnerable versions of faad2 library is affected.
💻 Affected Systems
- faad2 library
- Applications using faad2 (media players, converters, streaming software)
📦 What is this software?
Faad2 by Faad2 Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using faad2, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited code execution depending on exploit sophistication and system protections.
If Mitigated
Application crash with no code execution if ASLR/stack protections are effective.
🎯 Exploit Status
Exploit requires crafting malicious MP4 files; public PoC exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: faad2 2.10.1 and later
Vendor Advisory: https://github.com/knik0/faad2/issues/56
Restart Required: Yes
Instructions:
1. Update faad2 to version 2.10.1 or later. 2. Rebuild/reinstall applications using faad2. 3. Restart affected services/applications.
🔧 Temporary Workarounds
Disable MP4 processing
allConfigure applications to reject or not process MP4 files if functionality not required.
Application-specific configuration
Use alternative AAC decoder
linuxReplace faad2 with alternative AAC decoding library in applications.
Package manager commands to install alternative libraries
🧯 If You Can't Patch
- Implement strict input validation for MP4 files
- Run applications with minimal privileges and in sandboxed environments
🔍 How to Verify
Check if Vulnerable:
Check faad2 version: faad --version or check package manager (apt list --installed | grep faad2, rpm -qa | grep faad2)Check Version:
faad --version 2>/dev/null || echo "faad2 version: $(pkg-config --modversion faad2 2>/dev/null || dpkg -l | grep faad2 | awk '{print $3}' || rpm -q faad2)"Verify Fix Applied:
Verify installed faad2 version is 2.10.1 or higher📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults when processing MP4 files
- Unexpected process termination in media processing applications
Network Indicators:
- Unusual outbound connections from media processing applications
- Large MP4 file uploads to vulnerable endpoints
SIEM Query:
process_name:faad OR process_name:containing_faad AND (event_type:crash OR exit_code:139)