Critical DoS Vulnerability in FFmpeg Package: CPU Consumption Risk
Summary
ALPINE-CVE-2017-14170: In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports numerous codecs and formats, making it a versatile tool for developers and media professionals. However, FFmpeg versions prior to 3.1.11-r0 for Alpine v3.4 and v3.5, and prior to 3.2.8-r0 for Alpine v3.6, and prior to 3.3.4-r0 for Alpine v3.7 are vulnerable to a denial-of-service (DoS) attack due to a flaw in the mxf_read_index_entry_array function.
Vulnerability Detail
The vulnerability arises from a lack of an EOF (End of File) check in the mxf_read_index_entry_array function within the libavformat/mxfdec.c file of FFmpeg versions 3.3.3 and earlier. When a specially crafted MXF file is processed, it can claim a large 'nb_index_entries' field in the header without containing sufficient backing data. This results in an infinite loop that consumes excessive CPU resources, potentially leading to a denial of service. The issue can be triggered multiple times if the crafted file contains more than one applicable data segment.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider avoiding the processing of untrusted MXF files until the patch is applied. Additionally, implement resource limits on the application to mitigate the impact of potential DoS attacks.
Conclusion
In summary, the identified vulnerability in FFmpeg poses a significant risk of denial of service due to excessive CPU consumption when processing specially crafted MXF files. It is crucial to update to the patched versions to mitigate this risk effectively. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for ffmpeg →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The vulnerability specifically affects MXF files that are crafted to exploit the flaw in the mxf_read_index_entry_array function.
Exploitation of this vulnerability can lead to excessive CPU consumption, resulting in a denial of service for the affected application.
Yes, you can avoid processing untrusted MXF files and implement resource limits on your application to reduce the impact of potential DoS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
