CVE-2021-40570: 
NixOS vulnerability analysis and mitigation

The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, code execution, and escalation of privileges (NVD).

The vulnerability exists in the avc_compute_poc function within av_parsers.c file. The issue occurs when processing H.264/AVC video content, specifically during Picture Order Count (POC) computation. The vulnerability is triggered by a buffer overflow condition that leads to a double-free scenario. The CVSS v3.1 base score is 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to multiple severe consequences including denial of service, potential code execution, and privilege escalation. When successfully exploited, an attacker could crash the application, execute arbitrary code, or gain elevated privileges on the affected system (NVD).

The vulnerability has been patched in subsequent releases. A fix was implemented by adding a boundary check for poc_cycle_length in the SPS parsing code (Github Patch). For Debian systems, the fix is available in version 1.0.1+dfsg1-4+deb11u2 (Debian Security).