CVE-2021-38090
📋 TL;DR
This integer overflow vulnerability in FFmpeg's convolution filter allows attackers to cause denial of service or potentially execute arbitrary code by processing specially crafted video files. It affects systems using FFmpeg 4.2.1 for video processing. Applications that use FFmpeg libraries for video conversion or filtering are vulnerable.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the integer overflow enables memory corruption that can be weaponized.
Likely Case
Denial of service causing FFmpeg processes to crash when processing malicious video files.
If Mitigated
Process isolation limits impact to the FFmpeg service only, preventing system-wide compromise.
🎯 Exploit Status
Exploitation requires crafting a malicious video file that triggers the integer overflow in the filter16_roberts function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 99f8d32129dd233d4eb2efa44678a0bc44869f23 and later versions
Vendor Advisory: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23
Restart Required: Yes
Instructions:
1. Update FFmpeg to version 4.4 or later. 2. Rebuild any applications using FFmpeg libraries. 3. Restart services using FFmpeg.
🔧 Temporary Workarounds
Disable convolution filter
allPrevent use of the vulnerable filter16_roberts function by disabling convolution filter processing
ffmpeg -vf 'convolution=disable' input.mp4 output.mp4
🧯 If You Can't Patch
- Isolate FFmpeg processes using containerization or sandboxing
- Implement strict input validation for video files before processing
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version: ffmpeg -version | grep 'ffmpeg version'Check Version:
ffmpeg -version | head -1Verify Fix Applied:
Verify version is 4.4 or later, or check git commit hash includes 99f8d32129dd233d4eb2efa44678a0bc44869f23📡 Detection & Monitoring
Log Indicators:
- FFmpeg process crashes
- Segmentation fault errors in application logs
- Unexpected termination of video processing services
Network Indicators:
- Unusual video file uploads to processing services
- Repeated failed video processing requests
SIEM Query:
source="*ffmpeg*" AND ("segmentation fault" OR "SIGSEGV" OR "crash")