CVE-2021-36412
📋 TL;DR
A heap-based buffer overflow vulnerability in GPAC's MP4Box tool allows attackers to execute arbitrary code or cause denial of service by processing a specially crafted MP4 file. This affects systems running vulnerable versions of GPAC that process untrusted media files. The vulnerability is in the gp_rtp_builder_do_mpeg12_video function.
💻 Affected Systems
- GPAC
- MP4Box
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited code execution in the context of the MP4Box process.
If Mitigated
No impact if vulnerable software isn't processing untrusted files or if proper sandboxing/privilege separation is implemented.
🎯 Exploit Status
Proof-of-concept exists in GitHub issue #1838. Exploitation requires the victim to process a malicious file, which could be delivered via web uploads, email, or shared storage.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GPAC 1.0.1+ (patched versions available via distribution updates)
Vendor Advisory: https://github.com/gpac/gpac/issues/1838
Restart Required: No
Instructions:
1. Update GPAC to latest version from official repository. 2. For Debian/Ubuntu: apt update && apt upgrade gpac. 3. For source builds: git pull from GPAC repository and rebuild.
🔧 Temporary Workarounds
Disable MP4Box processing of untrusted files
linuxRestrict MP4Box usage to trusted files only through access controls.
chmod 750 /usr/bin/MP4Box
setfacl -m u:trusteduser:rx /usr/bin/MP4Box
Run MP4Box in sandboxed environment
linuxExecute MP4Box with reduced privileges using containerization or sandboxing.
docker run --read-only -v /trusted/files:/input:ro gpac mp4box ...
firejail --noprofile mp4box input.mp4
🧯 If You Can't Patch
- Implement strict input validation: only allow known-safe MP4 files from trusted sources.
- Monitor for crash logs of MP4Box process and investigate any abnormal terminations.
🔍 How to Verify
Check if Vulnerable:
Check GPAC version: mp4box -version | grep -i gpac. If version is 1.0.1 or earlier, assume vulnerable.Check Version:
mp4box -version 2>&1 | head -1Verify Fix Applied:
Confirm updated version: mp4box -version should show post-1.0.1 version. Test with known safe MP4 files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- MP4Box segmentation faults or abnormal termination
- System logs showing gpac/mp4box process crashes
- Core dumps in working directories
Network Indicators:
- Unusual outbound connections from systems running MP4Box
- File uploads to systems with MP4Box followed by process crashes
SIEM Query:
process_name="mp4box" AND (event_type="crash" OR exit_code="139" OR exit_code="-11")