Twenty One Zero-Days in FFmpeg
depthfirst.com
Twenty One Zero-Days in FFmpeg
1–10 of 216 posts
Re: Twenty One Zero-Days in FFmpeg
#2How does the browser use it ?unless they mean there’s a zero day in libavcodec
Re: Twenty One Zero-Days in FFmpeg
#3>The reach of this bug is what makes it serious. Any deployment that points FFmpeg at an attacker-influenced RTSP URL is exposed: media ingest pipelines fetching user-supplied stream URLs, surveillance and CCTV systems pulling RTSP feeds, and transcoding services processing remote AV1-over-RTP sources
Wow this is actually pretty serious - I'm even surprised its being published. There are several services where I can imagine this is exploitable today.
Re: Twenty One Zero-Days in FFmpeg
#4How does the browser use it ?unless they mean there’s a zero day in libavcodec
Browsers run it in a sandbox process together with allocator hardening. Most of the bugs then are just crashed of the sandbox
Another option is WASM or WASM-style sandboxes if using another process is undesirable.
Re: Twenty One Zero-Days in FFmpeg
#5How does the browser use it ?unless they mean there’s a zero day in libavcodec
[deleted]
Re: Twenty One Zero-Days in FFmpeg
#6> The reach of this bug is what makes it serious. Any deployment that points FFmpeg at an attacker-influenced RTSP URL is exposed: media ingest pipelines fetching user-supplied stream URLs, surveillance and CCTV systems pulling RTSP feeds, and transcoding services processing remote AV1-over-RTP sources Wow this is actually pretty serious - I'm even surprised its being published. There are several services where I can…
[dead]
Re: Twenty One Zero-Days in FFmpeg
#7I've been using ffmpeg for a very long time, both personally and for services I've built. Fabrice Bellard is a genius, and the developers who have taken it so far have made the world measurably richer.
But I can't think of a program more worthy of sandboxing when run with untrusted input than ffmpeg. It's a huge amount of C dealing with the most complicated video and audio codecs, which is notoriously impossible to get completely right.
But it's not actually that big of a problem. I run ffmpeg inside a VM or gVisor, and the end result is usually a video file that I'm perfectly willing to play in my browser, where it gets decoded in yet another sandbox because this shit is hard.
Re: Twenty One Zero-Days in FFmpeg
#8How does the browser use it ?unless they mean there’s a zero day in libavcodec
Browsers run it in a sandbox process together with allocator hardening. Most of the bugs then are just crashed of the sandbox Another option is WASM or WASM-style sandboxes if using another process is undesirable.
One chained sandbox escape away from compromise.
Re: Twenty One Zero-Days in FFmpeg
#9I've been using ffmpeg for a very long time, both personally and for services I've built. Fabrice Bellard is a genius, and the developers who have taken it so far have made the world measurably richer. But I can't think of a program more worthy of sandboxing when run with untrusted input than ffmpeg. It's a huge amount of C dealing with the most complicated video and audio codecs, which is notoriously impossible to g…
What do you mean "video file that I'm perfectly willing to play in my browser". Isn't it safe to assume that no video file can escape the browser decoding sandbox?
Re: Twenty One Zero-Days in FFmpeg
#10I've been using ffmpeg for a very long time, both personally and for services I've built. Fabrice Bellard is a genius, and the developers who have taken it so far have made the world measurably richer. But I can't think of a program more worthy of sandboxing when run with untrusted input than ffmpeg. It's a huge amount of C dealing with the most complicated video and audio codecs, which is notoriously impossible to g…
What do you mean "video file that I'm perfectly willing to play in my browser". Isn't it safe to assume that no video file can escape the browser decoding sandbox?
> Isn't it safe to assume that no video file can escape the browser decoding sandbox?
Why would that be safe to assume? If that were a reasonable assumption, you could just as well assume that it's safe to run ffmpeg.