CVE-2021-44923: 
NixOS vulnerability analysis and mitigation

A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application crash. The vulnerability was discovered and reported on December 10, 2021 (GitHub Issue, NVD).

The vulnerability occurs in the gf_dump_vrml_dyn_field.isra function when attempting to dereference a null pointer, leading to a segmentation fault. The issue can be triggered when processing certain files with the MP4Box utility. The crash occurs specifically at address 0x00007ffff7ac0797 in the gf_dump_vrml_dyn_field.isra function when attempting to execute a 'mov eax, dword ptr [r12]' instruction where r12 contains a null value (GitHub Issue).

When exploited, this vulnerability results in a denial of service condition through application crash. The vulnerability affects the application's stability and can interrupt normal operations when processing malformed input files (NVD).

The vulnerability can be triggered by processing specially crafted input files using the MP4Box utility with the -lsr parameter. A proof of concept has been demonstrated showing the crash can be reliably reproduced (GitHub Issue).

Users should upgrade to a version newer than 1.1.0 where this vulnerability has been addressed. If upgrading is not immediately possible, users should exercise caution when processing untrusted input files with the MP4Box utility (NVD).