Twenty One Zero-Days in FFmpeg

83 pointsposted 3 hours ago
by redbell
(depthfirst.com)

42 Comments

zerobees

2 hours ago

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago:

https://security.googleblog.com/2014/01/ffmpeg-and-thousand-...

So, while it's a demo of the capabilities of LLMs, this should not be at all surprising. Ffmpeg is absolutely not something you should be running outside of a sandbox if you're touching any untrusted or user-supplied content. I know that people do, and these people are taking unreasonable risks.

nerdsniper

an hour ago

Is GStreamer a more secure alternative or does it just get a bit less attention than ffmpeg?

loeg

an hour ago

They're also extremely hostile to security researchers who report these issues.

grahamjperrin

18 minutes ago

> … hostile to security researchers who report these issues.

Do you have an example?

gerdesj

an hour ago

ffmpeg is also rather popular and delivers a lot of functionality. Its unlikely that you don't have it installed.

Yes, there are security issues but quite a few are not ffmpeg itself related - the input is pretty shabby or at least not exactly easy to deal with!

Obviously, they could do with some assistance and I'm sure you and I will both dive in with equal zeal.

naturalmovement

an hour ago

If there was a nearly inexhaustible supply of Indian security researchers emailing you a nearly inexhaustible supply of LLM slop daily, there is a point where you or I would stop caring too.

ffmpeg is Free Software. You are also free not to use it.

Oddly enough, despite all these endless grievances, no one has come up with a better or more capable tool, certainly not one that is freely available.

Evidently no one cares either, because most implementations of ffmpeg I've seen typically run it as root "because we have to". Don't worry we use Docker bro.

LeoPanthera

7 minutes ago

You should rethink this kind of casual racism.

bawolff

an hour ago

> nearly inexhaustible supply of LLM slop daily,

Actual well written vulnerability reports are not the same as slop.

AI slop is a real problem and annoying. Just because it exists does not mean every vulnerability report is AI slop.

Ffmpeg devs are free not to care, but then they cant complain when they start to get a bad reputation.

naturalmovement

40 minutes ago

> AI slop is a real problem and annoying. Just because it exists does not mean every vulnerability report is AI slop.

Ok but who is going to sift through it all to triage the good bits when you're working on something for free?

> Ffmpeg devs are free not to care, but then they cant complain when they start to get a bad reputation

Who gives a shit about reputation when you're the only game in town?

There is nothing out there that even attempts to approximate an ffmpeg clone. They are the Swiss army knife of media encoding and all complainers have produced are plastic sporks.

nemothekid

3 hours ago

>The reach of this bug is what makes it serious. Any deployment that points FFmpeg at an attacker-influenced RTSP URL is exposed: media ingest pipelines fetching user-supplied stream URLs, surveillance and CCTV systems pulling RTSP feeds, and transcoding services processing remote AV1-over-RTP sources

Wow this is actually pretty serious - I'm even surprised its being published. There are several services where I can imagine this is exploitable today.

akerl_

2 hours ago

Some people might suggest it’s crucial to publish if you’re aware of a serious vulnerability, so that people using the software in a vulnerable way can take steps to mitigate the risk.

skupig

an hour ago

You would also need some sort of ASLR leak to make this exploitable

woodruffw

an hour ago

Speaking from firsthand experience: codec and other media processing libraries are some of the easiest software to find address leaks in.

(There are a number of reasons for this, not least being that C makes it very easy to ship partially initialized memory over the wire.)

wavemode

2 hours ago

> At this point the corrupted free pointer is called, and control of the instruction pointer is ours.

Very serious, though in practice it doesn't sound like this bug achieves arbitrary RCE on its own (especially in the presence of ASLR). You would need there to be some writable and executable page of memory lying around.

skupig

an hour ago

The article glosses over this, but it looks like the next variable in the struct is conveniently the first parameter to the function, so you can run arbitrary code with system() or whatever. But, yeah, you would need some other exploit to defeat ASLR.

da_chicken

an hour ago

That's not what "zero-day" means.

nerdsniper

an hour ago

It seems to have lost its meaning after getting popularized following Stuxnet coverage.

da_chicken

19 minutes ago

No, I think it was since Code Red.

I understand why it's poorly understood. It's a snappy term, and people assume it means "bad" and nothing else because that's all you can get from the context. However, since most people also don't know the difference between a vulnerability and an exploit, they won't understand the definition of a zero-day when they read it.

But I'm still going to complain if a security vulnerability research company is using the term incorrectly in their own press copy. It makes them look amateurish.

fizzynut

2 hours ago

I find difficult to know how serious the issue is, if it is even an issue.

LLM constantly confidently giving me this same sounding script with a "the root cause" and how it "is simple" while being completely incorrect.

josephg

a minute ago

Its 21 issues. And they've been human validated, as far as I can tell.

bayouborne

2 hours ago

What about VLC's own built-in versions of decoding libraries (I think, from the FFmpeg project)? Is there a scenario here where we may have to deal with malicious MP4 files?

jeffbee

40 minutes ago

All media containers are potentially hostile. Any offset, extent, or reference has to be considered hostile user-provided input.

lschueller

an hour ago

Inflated use of the term zero-day, while none of the described vulnerabilities is actually a zero-day. But it sounds and clicks good.. thank you for the PoC.

ttoinou

2 hours ago

Is the future of defense-against-foreign-agents-on-my-codebase to subtly hide prompt injections into one’s codebase that would defeat agents to find security bugs ?

If the attackers of ffmpeg need to be using such those authors’ services to find RCE in popular tools to attack, what the ffmpeg team needs to defeat attackers is to reduce efficiency of such tools depthfirst

omoikane

2 hours ago

Is there a timeline for each of these bugs? I wonder if these bugs had been reported to ffmpeg yet.

jacobgold

2 hours ago

I've been using ffmpeg for a very long time, both personally and for services I've built. Fabrice Bellard is a genius, and the developers who have taken it so far have made the world measurably richer.

But I can't think of a program more worthy of sandboxing when run with untrusted input than ffmpeg. It's a huge amount of C dealing with the most complicated video and audio codecs, which is notoriously impossible to get completely right.

But it's not actually that big of a problem. I run ffmpeg inside a VM or gVisor, and the end result is usually a video file that I'm perfectly willing to play in my browser, where it gets decoded in yet another sandbox because this shit is hard.

Gehinnn

2 hours ago

What do you mean "video file that I'm perfectly willing to play in my browser". Isn't it safe to assume that no video file can escape the browser decoding sandbox?

thaumasiotes

2 hours ago

> Isn't it safe to assume that no video file can escape the browser decoding sandbox?

Why would that be safe to assume? If that were a reasonable assumption, you could just as well assume that it's safe to run ffmpeg.

Denvercoder9

2 hours ago

I'm not up-to-speed with the current state of sandboxing in browsers, but in principle it's (on modern operating systems) not especially hard for them to sandbox the decoding into a separate process with basically no privileges beyond rendering a video stream. It's a bit trickier if we're only considering demuxing and delegating decoding to the hardware, but that's a much smaller attack surface.

A manually run ffmpeg on the command line does nothing to restrict its privileges, and its security model has very little interest in doing so, while browsers very much have.

ttoinou

2 hours ago

The parent does argues it is safer to sandbox ffmpeg yes

cyberax

2 hours ago

But then you also often need hardware accelerators for encoding, so you need to use C again.

tom_

36 minutes ago

> A victim only has to run ffmpeg -i rtsp://attacker/stream, the most ordinary command imaginable

What about "ls"?

bethekidyouwant

3 hours ago

How does the browser use it ?unless they mean there’s a zero day in libavcodec

fpoling

3 hours ago

Browsers run it in a sandbox process together with allocator hardening. Most of the bugs then are just crashed of the sandbox

Another option is WASM or WASM-style sandboxes if using another process is undesirable.

johnnythunder

2 hours ago

One chained sandbox escape away from compromise.

loeg

an hour ago

Which is of course better than zero sandbox escapes.

ttoinou

2 hours ago

Ahah

But are the compiler+OS that runs the ffmpeg executable really a sandbox ?

Philpax

an hour ago

"No way to prevent this" say users of only language where this regularly happens, etc, etc. Several of these bugs do not appear to be in hot code and would have been detected by a language with saner behaviour.