High CPU Consumption Vulnerability in FFmpeg Package
Summary
ALPINE-CVE-2017-14171: In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source software suite for handling multimedia data, including audio and video processing. It provides tools for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing various multimedia formats. The package is known for its versatility and performance, making it a popular choice among developers and media professionals. However, it has been found to contain a vulnerability that can lead to excessive CPU usage when processing certain malformed files.
Vulnerability Detail
The vulnerability arises from a lack of an End of File (EOF) check in the nsv_parse_NSVf_header() function within the libavformat/nsvdec.c file of FFmpeg versions 2.4 and 3.3.3. When a crafted NSV file is provided, which claims a large 'table_entries_used' field in the header but lacks sufficient backing data, the loop iterating over 'table_entries_used' can lead to significant CPU resource consumption. This can result in a Denial of Service (DoS) condition, affecting the performance of applications relying on FFmpeg for media processing.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing NSV files that are not from trusted sources or that you suspect may be malformed. Implementing input validation to check the integrity of NSV files before processing them can also mitigate the risk of triggering this vulnerability.
Conclusion
In summary, the vulnerability in FFmpeg can lead to significant CPU consumption when processing malformed NSV files. It is crucial to update to the patched versions of the package to mitigate this risk. Users should also consider implementing workarounds and monitoring tools like Vulert to ensure their applications remain secure.
See every vulnerability recorded for ffmpeg →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
FFmpeg versions 2.4 and 3.3.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include excessive CPU consumption leading to Denial of Service (DoS) conditions, which can affect the performance of applications using FFmpeg.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software by using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
