CVE-2023-6601
📋 TL;DR
This vulnerability in FFmpeg's HLS demuxer allows attackers to bypass file extension checks by using base64-encoded data URIs with specific extensions, potentially triggering arbitrary demuxers. It affects systems using vulnerable FFmpeg versions to process HLS streams. The impact is limited to applications that process untrusted HLS content.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary demuxer execution leading to memory corruption, potential code execution, or denial of service.
Likely Case
Application crashes or unexpected behavior when processing malicious HLS streams.
If Mitigated
No impact if proper input validation and patched versions are used.
🎯 Exploit Status
Exploitation requires crafting malicious HLS streams with base64-encoded data URIs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FFmpeg 6.1.1 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2253172
Restart Required: No
Instructions:
1. Update FFmpeg to version 6.1.1 or later. 2. Recompile applications using FFmpeg if statically linked. 3. Restart services using FFmpeg.
🔧 Temporary Workarounds
Disable HLS demuxer
linuxDisable HLS demuxer functionality in FFmpeg if not required.
Recompile FFmpeg with --disable-demuxer=hls
Input validation
allImplement strict input validation for HLS streams in applications.
🧯 If You Can't Patch
- Implement network segmentation to isolate FFmpeg processing systems.
- Use application-level firewalls to filter malicious HLS streams.
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version with 'ffmpeg -version' and compare to vulnerable versions.Check Version:
ffmpeg -version | grep 'ffmpeg version'Verify Fix Applied:
Verify FFmpeg version is 6.1.1 or later and test with known malicious HLS streams.📡 Detection & Monitoring
Log Indicators:
- FFmpeg crash logs
- Unexpected demuxer activation logs
Network Indicators:
- Unusual HLS stream patterns with base64 data URIs
SIEM Query:
source="ffmpeg.log" AND ("crash" OR "segmentation fault")