CVE-2022-37781: 
NixOS vulnerability analysis and mitigation

fdkaac v1.0.3 was discovered to contain a heap buffer overflow vulnerability via __interceptor_memcpy.part.46 at /sanitizer_common/sanitizer_common_interceptors.inc. The vulnerability was identified and disclosed on August 16, 2022 (Debian Tracker, GitHub Issue).

The vulnerability manifests as a heap buffer overflow condition that occurs during memory operations. The issue specifically involves the __interceptor_memcpy.part.46 function, which performs an invalid read of size 4 at a memory location outside the allocated buffer region. The vulnerability was discovered through Address Sanitizer testing, which detected a READ operation of size 4 occurring at an address beyond the bounds of an 8192-byte allocated region (GitHub Issue).

The heap buffer overflow vulnerability could potentially lead to memory corruption and application crashes. When exploited, the vulnerability triggers an AddressSanitizer error, indicating unauthorized memory access that could affect system stability (GitHub Issue).

The vulnerability can be triggered by processing specially crafted input files using the fdkaac command with specific parameters. A proof of concept exists demonstrating the exploitation using the command './fdkaac -p5 -b64 POC -o /dev/null' (GitHub Issue).

The issue was reported in version 1.0.3 of fdkaac. While no official patch has been explicitly mentioned in the available sources, users are advised to exercise caution when processing untrusted input files (Debian Tracker).