CVE-2022-47089: 
NixOS vulnerability analysis and mitigation

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b was discovered to contain a buffer overflow vulnerability in the gf_vvc_read_sps_bs_internal function located in media_tools/av_parsers.c. The vulnerability was assigned CVE-2022-47089 and was disclosed on December 12, 2022 (MITRE).

The vulnerability exists in the gf_vvc_read_sps_bs_internal function where a buffer overflow occurs when processing reference picture lists. Specifically, when the loop counter 'j' reaches 64, it causes an overflow of the sps->rps array. The issue was identified with GPAC version 2.1-DEV-rev574-g9d5bb184b-master. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The buffer overflow vulnerability could potentially lead to denial of service (DoS) conditions or remote code execution (RCE). The high CVSS score indicates that successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability can be triggered by importing a specially crafted MP4 file using the MP4Box utility. A proof of concept has been demonstrated using the command './MP4Box import -add poc.mp4', which results in a crash detected by the sanitizer (GitHub Issue).

The vulnerability affects versions up to (excluding) GPAC 2.2.0. Users should upgrade to GPAC version 2.2.0 or later to address this vulnerability (NVD).