CVE-2024-36615
📋 TL;DR
FFmpeg n7.0 has a race condition vulnerability in its VP9 decoder where video encoding parameters can be accessed simultaneously by decoder and output threads, causing a data race. This affects any application using FFmpeg's VP9 decoder functionality, particularly media processing servers and video applications.
💻 Affected Systems
- FFmpeg
📦 What is this software?
Ffmpeg by Ffmpeg
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to application crash, denial of service, or potential arbitrary code execution in FFmpeg process context.
Likely Case
Application instability, crashes, or corrupted video output during VP9 decoding operations.
If Mitigated
Minor performance impact or occasional decoding errors if race condition triggers.
🎯 Exploit Status
Race conditions are timing-dependent and difficult to reliably exploit. Requires specific VP9 content and concurrent thread execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 0ba058579f332b3060d8470a04ddd3fbf305be61 and later versions
Vendor Advisory: https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61
Restart Required: Yes
Instructions:
1. Update FFmpeg to version after commit 0ba058579f332b3060d8470a04ddd3fbf305be61
2. Recompile if using source
3. Restart all applications using FFmpeg
🔧 Temporary Workarounds
Disable VP9 decoder
allPrevent use of vulnerable VP9 decoder by disabling it at compile time or runtime
Configure with --disable-decoder=vp9 during build
Single-threaded decoding
allForce single-threaded operation to avoid race condition
Set AVCodecContext.thread_count = 1
🧯 If You Can't Patch
- Isolate FFmpeg processes in containers with limited privileges
- Implement input validation to reject untrusted VP9 content
🔍 How to Verify
Check if Vulnerable:
Check FFmpeg version and if built from n7.0 branch: ffmpeg -version | grep 'version\|commit'Check Version:
ffmpeg -versionVerify Fix Applied:
Verify commit hash includes 0ba058579f332b3060d8470a04ddd3fbf305be61 or later📡 Detection & Monitoring
Log Indicators:
- FFmpeg segmentation faults
- VP9 decoder errors
- Memory access violation logs
Network Indicators:
- Unexpected VP9 stream termination
- Media server crashes during decoding
SIEM Query:
process.name:"ffmpeg" AND (event.type:"crash" OR error.message:"segmentation fault")