Stack-Based Buffer Underflow in FAAD2: Denial of Service Vulnerability
Summary
ALPINE-CVE-2018-20194: There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. Affects faad2 versions < 2.9.0-r0. Fixed in 2.9.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FAAD2 (Freeware Advanced Audio Decoder 2) is a widely used audio decoder that supports various audio formats. It is known for its efficiency and high-quality audio playback. However, certain versions of FAAD2 are vulnerable to a stack-based buffer underflow, which can lead to denial of service and potentially other impacts when processing crafted input.
Vulnerability Detail
The vulnerability arises from a flaw in the calculate_gain function located in libfaad/sbr_hfadj.c. Specifically, the mishandling of noise energy levels for cases where G_max is less than or equal to G can lead to a stack-based buffer underflow. This can result in a denial of service, where the application may crash or become unresponsive, and could potentially allow for other unspecified impacts.
How To Fix
Minimum fixed version
2.9.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade faad2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider implementing input validation to ensure that only safe and expected inputs are processed by the FAAD2 decoder. This may help mitigate the risk of triggering the vulnerability.
Conclusion
The stack-based buffer underflow vulnerability in FAAD2 poses a significant risk, particularly in versions prior to 2.9.0-r0. It is crucial to update to the patched version to mitigate potential denial of service attacks and other impacts. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for faad2 →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
FAAD2 versions prior to 2.9.0-r0 are affected by this vulnerability.
The vulnerability can lead to denial of service, causing the application to crash or become unresponsive, and may allow for other unspecified impacts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement input validation to limit the risk of processing malicious input that could exploit the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for faad2.
