CVE-2024-35368
📋 TL;DR
CVE-2024-35368 is a double-free vulnerability in FFmpeg's rkmppdec.c component that allows memory corruption when processing certain media files. Attackers can exploit this to potentially execute arbitrary code or cause denial of service. This affects systems using FFmpeg n7.0 with RKMPP decoder support enabled.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service, potentially leading to service disruption.
If Mitigated
Contained crash within FFmpeg process with no privilege escalation if proper sandboxing exists.
🎯 Exploit Status
Proof-of-concept available in GitHub gist; exploitation requires feeding malicious media file to FFmpeg.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 4513300989502090c4fd6560544dce399a8cd53c and later
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html
Restart Required: Yes
Instructions:
1. Update FFmpeg to version with fix commit 2. Recompile if using custom build 3. Restart affected services
🔧 Temporary Workarounds
Disable RKMPP decoder
linuxDisable the vulnerable RKMPP decoder component at compile time
./configure --disable-decoder=rkmpp
make clean && make
Input validation
allImplement strict media file validation before FFmpeg processing
🧯 If You Can't Patch
- Implement strict network controls to limit media file sources
- Run FFmpeg in container/sandbox with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version and if RKMPP decoder is enabled: ffmpeg -decoders | grep rkmppCheck Version:
ffmpeg -version | head -1Verify Fix Applied:
Verify FFmpeg version includes commit 4513300989502090c4fd6560544dce399a8cd53c or later📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults
- Memory corruption errors in system logs
- Abnormal FFmpeg process termination
Network Indicators:
- Unusual media file uploads to processing services
- Multiple failed FFmpeg processing attempts
SIEM Query:
process.name:ffmpeg AND (event.action:segfault OR event.outcome:failure)