CVE-2021-21843: Buffer Overflow
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. After validating the number of ranges, at [41] the library will multiply the count by the size of the GFSubsegmentRangeInfo structure. On a 32-bit platform, this multiplication can result in an integer overflow causing the space of the array being allocated to be less than expected. An attacker can convince a user to open a video to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21843?
CVE-2021-21843 is classified as a high severity vulnerability due to its potential to cause significant heap-based buffer overflows.
How do I fix CVE-2021-21843?
To mitigate CVE-2021-21843, update GPAC to versions greater than or equal to 2.2.1+dfsg1-3, 1.0.1+dfsg1-4+deb11u3, or 0.5.2-426-gc5ad4e4+dfsg5-5.
What systems are affected by CVE-2021-21843?
CVE-2021-21843 affects GPAC versions 1.0.1 and earlier on Debian GNU/Linux systems, specifically versions 10.0 and 11.0.
What types of attacks can exploit CVE-2021-21843?
Exploitation of CVE-2021-21843 can lead to remote code execution through the processing of specially crafted MPEG-4 files.
Is there a proof of concept for CVE-2021-21843?
There are reported proof of concept exploits that demonstrate the integer overflow leading to a buffer overflow in CVE-2021-21843.