CVE-2021-3405: 
NixOS vulnerability analysis and mitigation

A heap overflow vulnerability (CVE-2021-3405) was discovered in libebml versions before 1.4.2. The vulnerability exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData functions. The issue was discovered in February 2021 and affects the library used for reading and writing files in the EBML (Extensible Binary Meta Language) format (NVD, Gentoo Security).

The vulnerability stems from a miscalculation in the buffer size allocation for string storage. On 32-bit builds, the value returned from GetSize() is implicitly cast to size_t in the new operator call, which can lead to truncation of the length value. For example, if the string element length is claimed to be 0xffffffff, the resultant allocation becomes 0x100000000, but the cast to 32-bit size_t drops the top bit, resulting in a zero-size allocation while still attempting to copy the full data length (Github Issue). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability could allow an attacker to trigger a heap-based buffer overflow, potentially leading to arbitrary code execution when processing maliciously crafted input files. This is particularly concerning as the vulnerability is reachable through popular applications that use libebml, such as VLC media player (Github Issue, Gentoo Security).

The vulnerability is particularly exploitable on 32-bit systems when the string element is maliciously placed at the end of the file to be parsed. A proof-of-concept exploit has been demonstrated using VLC on Ubuntu 10.10, confirming the practical exploitability of this vulnerability (Github Issue).

The vulnerability has been fixed in libebml version 1.4.2. Various Linux distributions have released security updates to address this issue, including Fedora, Debian, and Gentoo. Users are strongly advised to upgrade to version 1.4.2 or later of libebml (Debian LTS, Fedora Update, Gentoo Security).