CVE-2024-24265
📋 TL;DR
CVE-2024-24265 is a memory leak vulnerability in gpac v2.2.1 that occurs via the dst_props variable in the gf_filter_pid_merge_properties_internal function. This vulnerability could allow attackers to cause denial of service through resource exhaustion. Users and systems running the affected gpac version are impacted.
💻 Affected Systems
- gpac
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to denial of service, potentially affecting multiple services on the same host.
Likely Case
Degraded performance and eventual service crashes due to memory exhaustion over time.
If Mitigated
Limited impact with proper monitoring and resource limits in place.
🎯 Exploit Status
Exploitation requires triggering the specific memory leak path, which may require specific media processing operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.2.2 or later
Vendor Advisory: https://github.com/gpac/gpac/security/advisories
Restart Required: Yes
Instructions:
1. Check current gpac version. 2. Update to v2.2.2 or later using package manager or source compilation. 3. Restart any services using gpac.
🔧 Temporary Workarounds
Resource Limiting
linuxLimit memory usage of gpac processes to contain potential memory exhaustion.
ulimit -v [memory_limit_in_kb]
systemctl set-property [service_name] MemoryMax=[memory_limit_in_bytes]
Process Monitoring
allImplement monitoring to restart gpac processes when memory usage exceeds thresholds.
🧯 If You Can't Patch
- Implement strict memory limits on gpac processes
- Monitor process memory usage and restart services when thresholds are exceeded
🔍 How to Verify
Check if Vulnerable:
Check gpac version with 'gpac -version' or 'gpac --version' and verify if it's v2.2.1.Check Version:
gpac -versionVerify Fix Applied:
After updating, verify version is v2.2.2 or later using 'gpac -version'.📡 Detection & Monitoring
Log Indicators:
- Increasing memory usage patterns in gpac processes
- Process crashes with out-of-memory errors
Network Indicators:
- Unusual media processing request patterns
- Service unavailability after extended operation
SIEM Query:
process_name:gpac AND (memory_usage > threshold OR exit_code:137)