CVE-2024-50665
📋 TL;DR
This vulnerability in gpac's MP4Box tool is a NULL pointer dereference that causes a segmentation fault (SEGV) when processing specially crafted MP4 files with DRM encryption. It affects users who process untrusted media files with gpac 2.4. The crash could potentially be leveraged for denial of service or further exploitation.
💻 Affected Systems
- gpac
- MP4Box
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution if the crash can be weaponized with memory corruption techniques, though this is unlikely given the CWE classification.
Likely Case
Denial of service through application crash when processing malicious MP4 files.
If Mitigated
Minimal impact if proper input validation and sandboxing are in place.
🎯 Exploit Status
Exploitation requires feeding a malicious MP4 file to MP4Box. No authentication needed if file processing is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: gpac 2.5 or later
Vendor Advisory: https://github.com/gpac/gpac/issues/2987
Restart Required: No
Instructions:
1. Check current version with 'MP4Box -version'. 2. Update to gpac 2.5+ via package manager or compile from source. 3. Verify fix with 'MP4Box -version' showing 2.5+.
🔧 Temporary Workarounds
Disable DRM processing
allAvoid processing MP4 files with DRM encryption if not required.
# Configure applications to reject CENC-encrypted MP4 files
Input validation
linuxValidate MP4 files before processing with MP4Box.
# Use tools like 'file' or custom validation scripts
🧯 If You Can't Patch
- Restrict MP4Box to trusted, validated media files only
- Run MP4Box in sandboxed/containerized environments with limited privileges
🔍 How to Verify
Check if Vulnerable:
Run 'MP4Box -version' and check if output shows version 2.4. Any 2.4 version is vulnerable.Check Version:
MP4Box -versionVerify Fix Applied:
After update, run 'MP4Box -version' and confirm version is 2.5 or higher.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault (SEGV) errors in application logs
- MP4Box crash reports
- Core dumps from gpac processes
Network Indicators:
- Unusual MP4 file uploads to media processing services
- Repeated failed media processing attempts
SIEM Query:
process_name:"MP4Box" AND (event_type:crash OR error_message:"segmentation fault")