A critical vulnerability (CVE-2024-5171) has been identified in the libaom library developed by the Alliance for Open Media (AOMedia), which provides a reference implementation of the AV1 video encoding format. This vulnerability leads to an integer overflow and out-of-bounds write when processing overly large values in certain parameters. A similar vulnerability (CVE-2024-5197) has been found in the libvpx library, which implements the VP8 and VP9 codecs. The issues have been resolved in updates libaom 3.9.0 and libvpx 1.14.1. Vulnerabilities remain unpatched in distributions (Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, FreeBSD).
The vulnerabilities in libaom have been assigned the maximum severity level (10 out of 10), indicating the possibility of exploitation when processing specially crafted content in applications using this library. The severity level for libvpx is rated at 5.9 out of 10, corresponding to limited exploitation conditions. The primary danger of the vulnerabilities in libaom and libvpx stems from the fact that these libraries are used in web browsers, media players, and services that perform video transcoding.
The vulnerability manifests in libaom when calling the functions aom_img_alloc(), aom_img_wrap(), or aom_img_alloc_with_border() with large values in the parameters d_w, d_h, and align, leading to integer overflow when calculating offsets and buffer sizes. A similar overflow occurs in the functions vpx_img_alloc() and vpx_img_wrap(). These functions are used during video encoding.
The vulnerability poses the greatest risk due to the potential for browser attacks, where past similar vulnerabilities could be exploited by opening a specially crafted page in the browser that triggers JavaScript functions to encode video, or through manipulations with WebRTC. According to Google representatives, the vulnerability does not affect the Chromium engine, as only validated values of the arguments d_w and d_h were passed in the functions aom_img_alloc(), aom_img_wrap(), vpx_img_alloc(), and vpx_img_wrap(). Firefox uses the dav1d library for decoding AV1, but employs libaom for encoding. It remains unclear whether Firefox is affected by the issue, as information on how the vulnerability impacts specific products has not yet been published.
Source: opennet.ru
