CVE-2022-27147: 
NixOS vulnerability analysis and mitigation

GPAC mp4box version 1.1.0-DEV-rev1727-g8be34973d-master contains a use-after-free vulnerability in the function gf_node_get_attribute_by_tag. The vulnerability was discovered in February 2022 and affects the XML namespace handling functionality in the GPAC multimedia framework (Debian Security, GitHub Issue).

The vulnerability occurs in the gf_node_get_attribute_by_tag function within the src/scenegraph/xml_ns.c file. When processing XML namespace attributes, the code attempts to access memory that has been previously freed, leading to a use-after-free condition. This was detected by AddressSanitizer during testing with specific LSR (LASeR) content (GitHub Issue).

The use-after-free vulnerability could potentially lead to program crashes (denial of service) or possibly arbitrary code execution in the context of the application (Debian Security).

A proof-of-concept file that triggers the vulnerability has been created and tested. The issue can be reproduced by running MP4Box with the -lsr flag on specially crafted input files (GitHub Issue).

For Debian bullseye users, the vulnerability has been fixed in version 1.0.1+dfsg1-4+deb11u2. Users are recommended to upgrade their gpac packages to the patched version (Debian Security).