CVE-2023-6603
📋 TL;DR
This vulnerability in FFmpeg's HLS playlist parsing allows attackers to cause denial of service by triggering a null pointer dereference during initialization with a maliciously crafted HLS playlist. Any system using vulnerable FFmpeg versions to process HLS playlists is affected, including media servers, streaming applications, and video processing tools.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption causing media streaming failures, application crashes, and potential system instability on affected servers.
Likely Case
Application crashes or hangs when processing malicious HLS playlists, disrupting media streaming services temporarily.
If Mitigated
Minimal impact with proper input validation and sandboxing, though service interruptions may still occur.
🎯 Exploit Status
Exploitation requires feeding a malicious HLS playlist to vulnerable FFmpeg instances. No authentication needed if playlist processing is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check specific distribution packages (e.g., FFmpeg git commit that fixes the issue)
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2334335
Restart Required: Yes
Instructions:
1. Check your distribution's security advisories. 2. Update FFmpeg package using your package manager (apt-get upgrade ffmpeg, yum update ffmpeg, etc.). 3. Restart any services using FFmpeg. 4. Recompile any custom builds with patched source.
🔧 Temporary Workarounds
Disable HLS processing
allDisable HLS playlist parsing in FFmpeg if not required
Configure FFmpeg to reject HLS protocols or use input validation filters
Input validation and sanitization
allValidate and sanitize HLS playlist inputs before processing
Implement pre-processing scripts to check playlist structure
🧯 If You Can't Patch
- Implement network segmentation to isolate FFmpeg processing systems
- Use application sandboxing or containerization to limit crash impact
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version and compare against patched versions from your distribution. Test with known safe HLS playlists to ensure stability.Check Version:
ffmpeg -version | grep 'version'Verify Fix Applied:
After update, verify FFmpeg version and test processing of various HLS playlists to ensure no crashes occur.📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults
- Application crashes with null pointer references
- HLS processing failures
Network Indicators:
- Unusual HLS playlist requests to media servers
- Repeated failed media streaming sessions
SIEM Query:
source="*ffmpeg*" AND ("segmentation fault" OR "null pointer" OR "SIGSEGV")