CVE-2024-6064
📋 TL;DR
This vulnerability in GPAC's MP4Box tool is a use-after-free flaw in the xmt_node_end function that could allow local attackers to crash the application or potentially execute arbitrary code. It affects GPAC 2.5-DEV-rev228-g11067ea92-master and requires local access to exploit. Users who process untrusted XMT/MP4 files with MP4Box are at risk.
💻 Affected Systems
- GPAC MP4Box
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to arbitrary code execution with the privileges of the MP4Box process.
Likely Case
Application crash (denial of service) when processing malicious XMT files.
If Mitigated
No impact if MP4Box is not used or if untrusted files are not processed.
🎯 Exploit Status
Proof-of-concept exploit is publicly available in the GitHub issue. Requires local access and ability to run MP4Box with malicious input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit c1b9c794bad8f262c56f3cf690567980d96662f5
Vendor Advisory: https://github.com/gpac/gpac/issues/2874
Restart Required: No
Instructions:
1. Update GPAC to latest version with commit c1b9c794bad8f262c56f3cf690567980d96662f5. 2. Rebuild from source if using development version. 3. For packaged versions, wait for updated package from your distribution.
🔧 Temporary Workarounds
Disable MP4Box XMT processing
linuxRemove or restrict MP4Box execution for untrusted users
chmod 750 /usr/bin/MP4Box
setfacl -m u:untrusteduser:--- /usr/bin/MP4Box
Sandbox MP4Box execution
allRun MP4Box in container or sandbox when processing untrusted files
docker run --rm -v $(pwd):/data gpac mp4box [options]
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable GPAC versions
- Implement strict file validation before processing XMT files with MP4Box
🔍 How to Verify
Check if Vulnerable:
Check GPAC version: mp4box -version | grep 'version' and verify if it's before commit c1b9c794bad8f262c56f3cf690567980d96662f5Check Version:
mp4box -version 2>&1 | head -5Verify Fix Applied:
Verify commit hash in build: strings /usr/bin/MP4Box | grep c1b9c794bad8f262c56f3cf690567980d96662f5📡 Detection & Monitoring
Log Indicators:
- MP4Box segmentation faults
- Abnormal termination of MP4Box processes
Network Indicators:
- None - local exploitation only
SIEM Query:
process_name:"MP4Box" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://github.com/gpac/gpac/commit/c1b9c794bad8f262c56f3cf690567980d96662f5
- https://github.com/gpac/gpac/issues/2874
- https://github.com/user-attachments/files/15801189/poc.zip
- https://vuldb.com/?ctiid.268792
- https://vuldb.com/?id.268792
- https://vuldb.com/?submit.356316
- https://github.com/gpac/gpac/commit/c1b9c794bad8f262c56f3cf690567980d96662f5
- https://github.com/gpac/gpac/issues/2874
- https://github.com/user-attachments/files/15801189/poc.zip
- https://vuldb.com/?ctiid.268792
- https://vuldb.com/?id.268792
- https://vuldb.com/?submit.356316
