CVE-2024-35365
📋 TL;DR
CVE-2024-35365 is a double-free vulnerability in FFmpeg's audio stream initialization function that could allow attackers to execute arbitrary code or cause denial of service. This affects systems using FFmpeg version n6.1.1 for media processing. Attackers could exploit this by providing malicious media files to vulnerable FFmpeg instances.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Application crash causing denial of service and potential data corruption
If Mitigated
Limited impact with proper sandboxing and input validation
🎯 Exploit Status
Requires crafting malicious media files; exploitation depends on heap manipulation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5 and later versions
Vendor Advisory: https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5
Restart Required: No
Instructions:
1. Update FFmpeg to version after commit ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5. 2. Recompile any applications using FFmpeg library. 3. Replace vulnerable binaries with patched versions.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict validation of media files before processing with FFmpeg
Sandbox execution
LinuxRun FFmpeg in isolated containers or sandboxes with limited permissions
docker run --read-only --cap-drop=ALL -v /input:/input:ro ffmpeg
🧯 If You Can't Patch
- Implement strict network controls to limit FFmpeg's internet access
- Deploy application allowlisting to prevent unauthorized FFmpeg execution
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version: ffmpeg -version | grep 'version n6.1.1'Check Version:
ffmpeg -version | head -1Verify Fix Applied:
Verify FFmpeg version is newer than commit ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults
- Heap corruption errors
- Unexpected process termination
Network Indicators:
- Unusual outbound connections from FFmpeg processes
- Large media uploads to processing systems
SIEM Query:
process_name:ffmpeg AND (event_id:1000 OR exception_code:c0000005)