Heap-buffer-overflow in init_mt in libvpx
Summary
OSV-2022-529: Heap-buffer-overflow in init_mt. Affects libvpx versions >= 5b530fc962bcb8a51bbf03f5fbc2912f21b86e70, < 933b6b90a583b593efd8acb644603ab189226309. Fixed in 933b6b90a583b593efd8acb644603ab189226309. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvpx is an open-source library for encoding and decoding video streams in the VP8 and VP9 formats. It is widely used in various applications and platforms for video compression. The vulnerability in the init_mt function of libvpx can lead to a heap-buffer-overflow, potentially allowing an attacker to overwrite adjacent memory and execute arbitrary code.
Vulnerability Detail
The heap-buffer-overflow vulnerability in init_mt function of libvpx arises from a WRITE operation that exceeds the bounds of a heap buffer. This can be triggered during the decoding of a VP9 video frame. An attacker could craft a malicious video file that exploits this vulnerability, leading to a crash or potential remote code execution. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
933b6b90a583b593efd8acb644603ab189226309
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can disable the use of multi-threading in the libvpx library. This can be achieved by setting the appropriate configuration option or flag in the application code. However, this workaround may impact performance, especially in scenarios where multi-threading is beneficial for video decoding.
Conclusion
The heap-buffer-overflow vulnerability in the init_mt function of libvpx can have serious security implications. It is crucial for developers to update their applications or systems with the patched version of libvpx to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libvpx →
FAQ
libvpx is an open-source library used for video encoding and decoding in VP8 and VP9 formats.
The vulnerability can lead to a heap-buffer-overflow, potentially allowing an attacker to execute arbitrary code or crash the application.
Update the libvpx library to a version that includes the fix for this vulnerability.
Yes, developers can disable multi-threading in the libvpx library as a temporary workaround.
The vulnerability has been assigned a severity rating of HIGH.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvpx.
