CVE-2023-49501
📋 TL;DR
A buffer overflow vulnerability in FFmpeg's config_eq_output function allows local attackers to execute arbitrary code. This affects systems running vulnerable FFmpeg versions where local users can trigger audio filter processing. The vulnerability requires local access to exploit.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, data theft, or persistent backdoor installation.
Likely Case
Local user gains elevated privileges, potentially accessing sensitive data or disrupting system operations.
If Mitigated
Limited impact due to proper privilege separation and minimal local attack surface.
🎯 Exploit Status
Requires local access and ability to trigger specific audio filter processing functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check FFmpeg git repository for fixes after commit 466799d4f5
Vendor Advisory: https://trac.ffmpeg.org/ticket/10686
Restart Required: No
Instructions:
1. Update FFmpeg to latest version from official repository. 2. For package managers: 'sudo apt update && sudo apt upgrade ffmpeg' (Debian/Ubuntu) or 'sudo yum update ffmpeg' (RHEL/CentOS). 3. Recompile from source if using custom builds.
🔧 Temporary Workarounds
Restrict local user access
linuxLimit which users can execute FFmpeg or access audio processing functions
sudo chmod 750 /usr/bin/ffmpeg
sudo setfacl -m u:username:rx /usr/bin/ffmpeg
Disable vulnerable component
allAvoid using the asrc_afirsrc audio filter if possible
🧯 If You Can't Patch
- Implement strict privilege separation - run FFmpeg with minimal privileges using sudo restrictions or containers
- Monitor for unusual FFmpeg process execution patterns and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version: 'ffmpeg -version' and compare with vulnerable version rangeCheck Version:
ffmpeg -version | head -1Verify Fix Applied:
Verify updated version no longer contains vulnerable commit: 'ffmpeg -version | grep -i version'📡 Detection & Monitoring
Log Indicators:
- Unusual FFmpeg process execution by non-privileged users
- Segmentation faults in FFmpeg processes
- Privilege escalation attempts following FFmpeg execution
Network Indicators:
- None - local vulnerability
SIEM Query:
Process creation where parent process is ffmpeg and new process has elevated privileges🔗 References
- https://github.com/FFmpeg/FFmpeg
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/
- https://trac.ffmpeg.org/ticket/10686
- https://trac.ffmpeg.org/ticket/10686#no1
- https://github.com/FFmpeg/FFmpeg
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/
- https://trac.ffmpeg.org/ticket/10686
- https://trac.ffmpeg.org/ticket/10686#no1
