CVE-2021-40576: 
NixOS vulnerability analysis and mitigation

The vulnerability CVE-2021-40576 affects the binary MP4Box in Gpac version 1.0.1. It is a null pointer dereference vulnerability located in the gf_isom_get_payt_count function within hint_track.c, which allows attackers to cause a denial of service (NVD, Debian Tracker). The vulnerability was discovered and disclosed in January 2022.

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 Base Score of 5.5 (MEDIUM). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is unchanged (S:U), with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (NVD).

When exploited, the vulnerability can lead to a denial of service condition through a segmentation fault caused by the null pointer dereference. This primarily affects the availability of the system running the MP4Box binary (Github Issue).

The vulnerability has been fixed in GPAC through a commit that adds a null pointer check in the GetHintFormat function. Users are advised to upgrade to a patched version. For Debian systems, the fix has been included in version 1.0.1+dfsg1-4+deb11u2 (Debian Security, Github Patch).