CVE-2024-35366
📋 TL;DR
This CVE-2024-35366 is an integer overflow vulnerability in FFmpeg's libavformat module that allows attackers to cause denial of service or potentially execute arbitrary code by providing malicious input with negative duration values. It affects systems running FFmpeg version n6.1.1 when processing certain media files. The vulnerability is particularly dangerous because FFmpeg is widely used for media processing across many applications and platforms.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing FFmpeg to crash, potentially disrupting media processing services or applications.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially just application crashes.
🎯 Exploit Status
The vulnerability is in a core parsing function and requires only specially crafted media files. Public references show the exact vulnerable code location, making exploitation straightforward for attackers with basic reverse engineering skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 0bed22d597b78999151e3bde0768b7fe763fc2a6 and later versions
Vendor Advisory: https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6
Restart Required: Yes
Instructions:
1. Update FFmpeg to the latest version from the official repository. 2. Recompile any applications that statically link FFmpeg. 3. Restart all services and applications using FFmpeg. 4. Verify the fix by checking the version and testing with known vulnerable inputs.
🔧 Temporary Workarounds
Input validation wrapper
allImplement pre-processing validation for media files before passing to FFmpeg
# Example: Use file command to validate before processing
if file --mime-type "$input_file" | grep -q "video/\|audio/\|image/"; then
ffmpeg -i "$input_file" ...
else
echo "Invalid file type"
exit 1
fi
Sandbox execution
linuxRun FFmpeg in a container or sandbox with limited privileges
# Docker example
docker run --rm -v $(pwd):/data ffmpeg -i /data/input.mp4 /data/output.mp4
# Bubblewrap example
bwrap --ro-bind /usr /usr --ro-bind /lib /lib --ro-bind /lib64 /lib64 --bind $(pwd) $(pwd) --dev /dev --proc /proc ffmpeg -i input.mp4 output.mp4
🧯 If You Can't Patch
- Disable or restrict media file upload/processing capabilities in vulnerable applications
- Implement network segmentation to isolate systems running vulnerable FFmpeg versions
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version: ffmpeg -version | grep 'version' and verify if it's n6.1.1. Test with a crafted media file containing negative duration values.Check Version:
ffmpeg -version | grep -E 'version|built'Verify Fix Applied:
Update FFmpeg and verify the version is newer than n6.1.1. Test with the same crafted media file that previously caused crashes - it should now be rejected or handled safely.📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults or abnormal termination
- Unexpected process crashes during media processing
- Error messages mentioning sbgdec.c or parse_options
Network Indicators:
- Unusual media file uploads to web applications
- Multiple failed media processing attempts
- Traffic patterns suggesting media file fuzzing
SIEM Query:
source="*ffmpeg*" AND ("segmentation fault" OR "SIGSEGV" OR "aborted" OR "parse_options")