CVE-2024-5171 – CVE-2024-5171 is an integer overflow vulnerabil... (How to Fix)

Q: What is the severity of CVE-2024-5171?

CVE-2024-5171 has a CVSS score of 9.8 (CRITICAL). CVE-2024-5171 is an integer overflow vulnerability in libaom's image allocation functions that can lead to heap buffer overflow when processing large image dimensions. This allows attackers to potentially execute arbitrary code or cause denial of service. Any application using vulnerable versions of libaom (AV1 video codec library) is affected.

📋 TL;DR

CVE-2024-5171 is an integer overflow vulnerability in libaom's image allocation functions that can lead to heap buffer overflow when processing large image dimensions. This allows attackers to potentially execute arbitrary code or cause denial of service. Any application using vulnerable versions of libaom (AV1 video codec library) is affected.

💻 Affected Systems

Products:

libaom
Applications using libaom library
Chromium-based browsers
FFmpeg with libaom support
Media processing tools

Versions: libaom versions before 3.9.0

Operating Systems: Linux, Windows, macOS, All platforms with vulnerable libaom

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability is triggered when processing images with large dimensions or alignment parameters.

📦 What is this software?

Libaom by Aomedia

View all CVEs affecting Libaom →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Application crash (denial of service) or limited memory corruption leading to unstable behavior.

🟢

If Mitigated

Application crash with no further impact if memory protections (ASLR, DEP) are effective.

🌐 Internet-Facing: HIGH - Many media processing applications and web services use libaom for AV1 video handling.

🏢 Internal Only: MEDIUM - Internal applications using libaom for video processing could be exploited by authenticated users.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting specific image parameters but doesn't require authentication. No public exploits confirmed yet.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: libaom 3.9.0 and later

Vendor Advisory: https://issues.chromium.org/issues/332382766

Restart Required: Yes

Instructions:

1. Update libaom to version 3.9.0 or later. 2. Rebuild applications linked against libaom. 3. Restart affected services. 4. For Linux distributions, use package manager: 'sudo apt update && sudo apt upgrade libaom' (Debian/Ubuntu) or 'sudo dnf update libaom' (Fedora/RHEL).

🔧 Temporary Workarounds

Input validation wrapper

all

Implement input validation for image dimensions before passing to libaom functions

# Example Python validation: if d_w > 10000 or d_h > 10000: raise ValueError('Image dimensions too large')

Memory limit enforcement

linux

Use ulimit or container memory limits to restrict impact of potential overflow

ulimit -v 1048576
docker run --memory=1g your_application

🧯 If You Can't Patch

Implement strict input validation for all image dimensions passed to libaom functions
Isolate media processing services in containers with strict memory limits and network restrictions

🔍 How to Verify

Check if Vulnerable:

Check libaom version: 'pkg-config --modversion aom' or 'ldconfig -p | grep libaom'

Check Version:

pkg-config --modversion aom || aomdec --version 2>/dev/null || grep -i version $(ldconfig -p | grep libaom | head -1 | awk '{print $4}')

Verify Fix Applied:

Verify libaom version is 3.9.0 or higher: 'aomdec --version' or check package version

📡 Detection & Monitoring

Log Indicators:

Application crashes with segmentation faults
Memory allocation failures in media processing
Unusual large image dimension parameters in logs

Network Indicators:

Unusually large image files being uploaded
AV1 video streams with abnormal dimensions

SIEM Query:

source="application.log" AND ("segmentation fault" OR "heap overflow" OR "libaom") AND (d_w>10000 OR d_h>10000)

📊 Metadata

CVE ID: CVE-2024-5171

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-20

Published: June 5, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-5171, you might also want to check these: