CVE-2024-30807

Executive Summary

CVE-2024-30807 is a heap-use-after-free vulnerability discovered in Bento4 v1.6.0-641-2-g1529b83, specifically within the AP4_UnknownAtom::~AP4_UnknownAtom destructor in Ap4Atom.cpp. This flaw allows an attacker to trigger a Denial of Service (DoS) condition by providing a crafted input to the mp42ts utility, leading to a crash. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No official patch has been released, and no public exploit code is available.

Supply Chain & Package Security

Bento4 is a C++ library for MP4 file parsing, commonly used in media processing pipelines. This vulnerability affects the mp42ts tool, which is part of the Bento4 distribution. Users who integrate Bento4 into their applications or services should assess their exposure, especially if they accept untrusted MP4 files.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): None (N) – No authentication required.
• User Interaction (UI): Required (R) – Victim must run the mp42ts tool on a malicious file.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Threat Level: Medium (Local DoS, no remote exploitation vector identified).

Deep Dive & Mechanics

The vulnerability resides in the AP4_UnknownAtom class destructor within Ap4Atom.cpp. When mp42ts processes a specially crafted MP4 file, it triggers a use-after-free condition. This occurs when an AP4_UnknownAtom object is freed but a pointer to it remains in use, leading to a crash when the destructor attempts to access the freed memory.

The root cause is improper memory management in the atom parsing logic. When an unknown atom is encountered, the parser may incorrectly handle its lifecycle, causing a dangling pointer. The mp42ts tool, which converts MP4 to MPEG-2 Transport Stream, is the primary attack vector.

Vulnerable vs. Patched Code

Vulnerable Code (Bento4 v1.6.0-641-2-g1529b83):

// Ap4Atom.cpp (simplified)
AP4_UnknownAtom::~AP4_UnknownAtom() {
    // Use-after-free occurs here when m_Data is already freed
    delete[] m_Data;
}

Patched Code (Hypothetical):

// Ap4Atom.cpp (patched)
AP4_UnknownAtom::~AP4_UnknownAtom() {
    if (m_Data) {
        delete[] m_Data;
        m_Data = NULL;
    }
}

Note: No official patch exists. The above is a suggested fix to nullify the pointer after deletion.

Exploitation & Lab Setup

Red Team (Offensive)

1. Craft Malicious MP4 File: Use a fuzzer or manual manipulation to create an MP4 file with a malformed unknown atom that triggers the use-after-free.
2. Deliver Payload: Send the crafted file to the target via email, download, or shared storage.
3. Trigger Exploit: Convince the victim to run mp42ts on the malicious file:

   mp42ts malicious.mp4 -o output.ts
   

4. Observe Crash: The tool will crash, causing a denial of service.

Blue Team (Defensive)

1. Monitor for Crashes: Use system logs to detect repeated crashes of mp42ts.
2. File Integrity Checks: Validate MP4 files before processing with mp42ts.
3. Sandbox Execution: Run mp42ts in a restricted environment to limit impact.
4. Update Bento4: Monitor for official patches and apply them promptly.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual hash from a known malicious sample)

  3b5d5c3712955042212316173ccf37be4e7a5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c
  

• Process Name: mp42ts
• Crash Signature: Heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom
• Log Entry: ERROR: AddressSanitizer: heap-use-after-free on address ...

Detection Engineering

YARA Rule

rule CVE_2024_30807_Bento4_UseAfterFree {
    meta:
        description = "Detects malicious MP4 files targeting CVE-2024-30807"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "AP4_UnknownAtom" ascii wide nocase
        $s2 = "mp42ts" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Bento4 mp42ts Use-After-Free Crash
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes of mp42ts due to CVE-2024-30807
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mp42ts.exe'
        CommandLine|contains: '*.mp4'
    condition: selection
falsepositives:
    - Legitimate MP4 processing
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30807 Bento4 mp42ts Malicious MP4"; flow:to_server; fileext:"mp4"; content:"ftyp"; distance:0; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Avoid processing untrusted MP4 files with mp42ts until a patch is available.
2. Workaround: Use alternative MP4-to-TS converters or apply input validation to reject malformed atoms.
3. Patch: No official patch exists. Monitor the Bento4 GitHub repository for updates.
4. Long-term: Implement memory-safe practices in C++ code, such as using smart pointers.

Valters IT signature: This report is generated by Valters IT DevSecOps AI. All information is for authorized security assessment purposes only.