CVE-2024-31005

Executive Summary

CVE-2024-31005 is a critical memory corruption vulnerability in Bento4 v1.6.0-641, specifically within the AP4_MdhdAtom::AP4_MdhdAtom constructor in Ap4MdhdAtom.cpp. The flaw is triggered when processing a crafted MP4 file via the mp4fragment utility, allowing a remote attacker to execute arbitrary code. The vulnerability stems from improper bounds checking or memory handling during the parsing of the Media Header Box (mdhd). No public exploit code or patch is currently available, and the CVSS score remains unassigned. The EPSS score of 0.0% indicates low exploitation activity in the wild, but the potential for remote code execution makes this a high-priority issue for any system using Bento4 to process untrusted MP4 files.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): Required (user must open a malicious file)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical (based on RCE potential)

Deep Dive & Mechanics

The vulnerability resides in the AP4_MdhdAtom constructor within Ap4MdhdAtom.cpp. The mdhd box is a mandatory box in an MP4 file that defines media header information, including timescale and duration. The flaw likely involves an integer overflow, buffer overflow, or use-after-free when parsing malformed mdhd box fields. Specifically, the mp4fragment tool, which splits MP4 files into fragments, calls this constructor without proper validation of the input data. An attacker can craft an MP4 file with a specially corrupted mdhd box that, when parsed, corrupts heap memory or overwrites critical pointers, leading to arbitrary code execution.

The attack vector is remote: an attacker hosts a malicious MP4 file or tricks a user into opening it with mp4fragment. No authentication is required, and the only user interaction is opening the file.

Vulnerable vs. Patched Code

Vulnerable Code (Bento4 v1.6.0-641):

// Ap4MdhdAtom.cpp (simplified vulnerable version)
AP4_MdhdAtom::AP4_MdhdAtom(AP4_Size size, AP4_ByteStream& stream)
    : AP4_Atom(AP4_ATOM_TYPE_MDHD, size)
{
    // Read version and flags
    AP4_UI08 version;
    stream.ReadUI08(version);
    stream.ReadUI24(m_Flags);

    // Vulnerable: no bounds check on size before reading
    if (version == 0) {
        stream.ReadUI32(m_CreationTime);
        stream.ReadUI32(m_ModificationTime);
        stream.ReadUI32(m_TimeScale);
        stream.ReadUI32(m_Duration);
    } else {
        stream.ReadUI64(m_CreationTime);
        stream.ReadUI64(m_ModificationTime);
        stream.ReadUI32(m_TimeScale);
        stream.ReadUI64(m_Duration);
    }
    // No validation of m_Duration or m_TimeScale
}

Patched Code (Hypothetical):

// Ap4MdhdAtom.cpp (patched version)
AP4_MdhdAtom::AP4_MdhdAtom(AP4_Size size, AP4_ByteStream& stream)
    : AP4_Atom(AP4_ATOM_TYPE_MDHD, size)
{
    AP4_UI08 version;
    AP4_Result result;

    result = stream.ReadUI08(version);
    if (AP4_FAILED(result)) return;

    result = stream.ReadUI24(m_Flags);
    if (AP4_FAILED(result)) return;

    // Validate remaining size before reading
    AP4_Size expected_size = (version == 0) ? 4*4 : 4*2 + 8*3;
    if (size < expected_size + 4) { // +4 for version+flags
        // Error: malformed atom
        return;
    }

    if (version == 0) {
        stream.ReadUI32(m_CreationTime);
        stream.ReadUI32(m_ModificationTime);
        stream.ReadUI32(m_TimeScale);
        stream.ReadUI32(m_Duration);
    } else {
        stream.ReadUI64(m_CreationTime);
        stream.ReadUI64(m_ModificationTime);
        stream.ReadUI32(m_TimeScale);
        stream.ReadUI64(m_Duration);
    }
    // Additional validation of m_Duration and m_TimeScale
    if (m_TimeScale == 0) {
        // Error: invalid timescale
    }
}

Exploitation & Lab Setup

Red Team (Exploitation):

1. Setup: Install Bento4 v1.6.0-641 on a Linux VM. Obtain the mp4fragment binary.
2. Craft Malicious MP4: Use a hex editor or a fuzzer to create an MP4 file with a malformed mdhd box. For example, set the size field of the mdhd box to a value smaller than the actual data, causing a heap overflow when reading fields.
3. Trigger: Run ./mp4fragment malicious.mp4 output.mp4. The crash should occur in AP4_MdhdAtom::AP4_MdhdAtom.
4. Exploit: Develop a heap spray or ROP chain to achieve code execution. Since no public exploit exists, this requires custom development.

Blue Team (Detection & Defense):

1. Monitor: Deploy file integrity monitoring on systems using Bento4. Alert on any crash of mp4fragment.
2. Sandbox: Run mp4fragment in a sandboxed environment with limited privileges.
3. Input Validation: Implement a pre-filter for MP4 files that checks the mdhd box size before passing to Bento4.
4. Logging: Enable detailed logging for Bento4 processes to capture crash dumps.

Indicators of Compromise (IOCs)

• File Hashes (Malicious MP4): (None publicly known)
• Process Anomalies: mp4fragment crashing with segmentation fault (SIGSEGV) when processing MP4 files.
• Network: Outbound connections from a compromised system after exploitation (e.g., reverse shell).
• Registry/File System: Modified Bento4 binaries or dropped payloads in temp directories.

Detection Engineering

YARA Rule:

rule CVE_2024_31005_Malicious_MP4 {
    meta:
        description = "Detects MP4 files with malformed mdhd box targeting CVE-2024-31005"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $mdhd = "mdhd" nocase
        $small_size = { 00 00 00 0? } // size field less than 0x20
    condition:
        $mdhd at 0 and $small_size
}

Sigma Rule:

title: Bento4 mp4fragment Crash Detection
id: 7a8b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects crashes of mp4fragment due to CVE-2024-31005
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mp4fragment'
        ExitCode: -11  # SIGSEGV
    condition: selection
falsepositives:
    - Legitimate crashes due to corrupted files
level: high

Suricata Rule:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-31005 Bento4 mp4fragment Exploit Attempt"; flow:to_server,established; content:"mdhd"; offset:0; depth:4; content:"|00 00 00|"; within:4; byte_test:4,<,32,0,relative; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or remove mp4fragment from production systems if not essential.
2. Short-term: Implement input validation for MP4 files before processing with Bento4. Use a separate library to parse and validate the mdhd box.
3. Long-term: Upgrade to a patched version of Bento4 once available. Monitor the Bento4 GitHub repository for updates.
4. Workaround: Use an alternative MP4 processing tool (e.g., FFmpeg) until a patch is released.

Valters IT
DevSecOps & Cyber Threat Intelligence