Critical DoS Vulnerability in FFmpeg Package Leading to High CPU Consumption
Summary
ALPINE-CVE-2017-14054: In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports various formats and codecs, making it a versatile tool for developers and media professionals. However, certain versions of FFmpeg are vulnerable to a denial-of-service (DoS) attack due to a flaw in the handling of IVR files, which can lead to excessive CPU usage.
Vulnerability Detail
In libavformat/rmdec.c of FFmpeg version 3.3.3, a denial-of-service vulnerability exists in the ivr_read_header() function. This flaw arises from the absence of an EOF (End of File) check, which can be exploited by providing a crafted IVR file that claims a large 'len' field in the header but lacks sufficient backing data. As a result, the first type==4 loop can consume significant CPU resources, leading to a potential DoS condition.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted IVR files until the package is updated to a secure version. Implementing input validation to check the integrity of IVR files before processing may also help mitigate the risk.
Conclusion
The identified vulnerability in FFmpeg poses a serious risk of denial-of-service due to excessive CPU consumption when processing malicious IVR files. It is crucial to update to the patched versions to safeguard against potential exploitation.
See every vulnerability recorded for ffmpeg →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
FFmpeg versions prior to 3.1.11-r0 for Alpine v3.4 and v3.5, and prior to 3.2.8-r0 for Alpine v3.6, and prior to 3.3.4-r0 for Alpine v3.7 are affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software by simply using a manifest file like package-lock.json. You can also check your application on the Vulert playground without any signup.
Exploitation of this vulnerability can lead to significant CPU consumption, potentially causing the application to become unresponsive and resulting in a denial-of-service condition.
Yes, avoid processing untrusted IVR files and implement input validation to ensure the integrity of files before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
