CVE-2023-47470
📋 TL;DR
A buffer overflow vulnerability in FFmpeg's ref_pic_list_struct function allows remote attackers to write outside array bounds, potentially executing arbitrary code or causing denial of service. This affects systems processing EVC (Essential Video Coding) video streams with vulnerable FFmpeg versions. Attackers can exploit this by providing malicious video files.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the FFmpeg process, potentially leading to full system compromise if FFmpeg runs with elevated privileges.
Likely Case
Denial of service through application crashes when processing malicious video files, potentially disrupting media processing services.
If Mitigated
Limited impact if FFmpeg runs in sandboxed environments with minimal privileges and input validation is enforced.
🎯 Exploit Status
Exploitation requires crafting malicious EVC video files; public reports and PoC exist in the referenced GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 4565747056a11356210ed8edcecb920105e40b60
Vendor Advisory: https://github.com/FFmpeg/FFmpeg/commit/4565747056a11356210ed8edcecb920105e40b60
Restart Required: Yes
Instructions:
1. Update FFmpeg to version including commit 4565747056a11356210ed8edcecb920105e40b60 or later. 2. Rebuild from source if using custom builds. 3. Restart all services using FFmpeg.
🔧 Temporary Workarounds
Disable EVC codec processing
allPrevent FFmpeg from processing EVC video streams to block exploitation vectors
ffmpeg -codecs | grep evc
Reconfigure applications to reject EVC format inputs
Sandbox FFmpeg execution
linuxRun FFmpeg in containerized or restricted environments to limit exploit impact
docker run --security-opt no-new-privileges ffmpeg-container
Use seccomp profiles or AppArmor
🧯 If You Can't Patch
- Implement strict input validation to reject untrusted video files
- Deploy network segmentation to isolate FFmpeg processing systems
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version and commit hash: ffmpeg -version | grep -i 'version\|commit'Check Version:
ffmpeg -version | head -1Verify Fix Applied:
Verify commit 4565747056a11356210ed8edcecb920105e40b60 is present: git log --oneline | grep 4565747056📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults or abnormal termination when processing video files
- Error messages referencing evc_ps.c or ref_pic_list_struct
Network Indicators:
- Unusual uploads of EVC format video files to media processing services
SIEM Query:
source="*ffmpeg*" AND ("segmentation fault" OR "SIGSEGV" OR "evc_ps.c")🔗 References
- https://github.com/FFmpeg/FFmpeg/commit/4565747056a11356210ed8edcecb920105e40b60
- https://github.com/goldds96/Report/tree/main/FFmpeg
- https://patchwork.ffmpeg.org/project/ffmpeg/patch/20230915131147.5945-2-michael%40niedermayer.cc/
- https://github.com/FFmpeg/FFmpeg/commit/4565747056a11356210ed8edcecb920105e40b60
- https://github.com/goldds96/Report/tree/main/FFmpeg
- https://patchwork.ffmpeg.org/project/ffmpeg/patch/20230915131147.5945-2-michael%40niedermayer.cc/
