oss-security - OpenH264 Decoding Functions Heap Overflow Vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <edeee8b3-9add-499c-820a-38ac2fd535f3@oracle.com>
Date: Fri, 21 Feb 2025 09:54:48 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: OpenH264 Decoding Functions Heap Overflow
 Vulnerability

https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x reports:

> Description
> -----------
> A vulnerability in the decoding functions of OpenH264 codec library could
> allow a remote, unauthenticated attacker to trigger a heap overflow.
> 
> This vulnerability is due to a race condition between a Sequence Parameter
> Set (SPS) memory allocation and a subsequent non Instantaneous Decoder
> Refresh (non-IDR) Network Abstraction Layer (NAL) unit memory usage.
> An attacker could exploit this vulnerability by crafting a malicious
> bitstream and tricking a victim user into processing an arbitrary video
> containing the malicious bistream. An exploit could allow the attacker to
> cause an unexpected crash in the victim's user decoding client and, possibly,
> perform arbitrary commands on the victim's host by abusing the heap overflow.
> 
> Conditions
> ----------
> This vulnerability affects OpenH264 2.5.0 and earlier releases.
> 
> Both Scalable Video Coding (SVC) mode and Advanced Video Coding (AVC) mode
> are affected by this vulnerability
> 
> Fixed Software
> --------------
> OpenH264 software releases 2.6.0 and later contained the fix for this
> vulnerability.
> 
> For more information
> --------------------
> 
> If you have any questions or comments about this advisory:
> 
>   - Open an issue in https://github.com/cisco/openh264
>   - Email Cisco Open Source Security (oss-security@...co.com) and
>     Cisco PSIRT (psirt@...co.com)
> 
> Credits:
> 
>     Research: Octavian Guzu and Andrew Calvano of Meta
>     Fix ideation: Philipp Hancke and Shyam Sadhwani of Meta
>     Fix implementation: Benzheng Zhang (@BenzhengZhang)
>     Release engineering: Benzheng Zhang (@BenzhengZhang)


-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.