CVE-2022-47094: 
NixOS vulnerability analysis and mitigation

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to a Null pointer dereference vulnerability in the m2tsdmx_declare_pid function located at filters/dmx_m2ts.c:343. The vulnerability was discovered in December 2022 and affects GPAC versions up to (excluding) 2.2.0 (NVD, Debian Tracker).

The vulnerability is characterized by a null pointer dereference in the m2tsdmx_declare_pid function, specifically at line 343 of the filters/dmx_m2ts.c file. The issue has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access vector with low attack complexity and no privileges required (NVD).

The null pointer dereference vulnerability can lead to a denial of service condition and potentially allow for remote code execution when processing malformed input files. The vulnerability affects the MPEG-2 TS demuxer component of GPAC (GitHub Issue).

The vulnerability can be triggered through a specially crafted input file that causes a member access within a null pointer of type 'struct GF_InitialObjectDescriptor'. A proof of concept has been documented showing the crash can be reproduced using the MP4Box import functionality (GitHub Issue).

The vulnerability has been fixed in GPAC version 2.2.0 and later releases. For Debian systems, the fix has been backported to version 1.0.1+dfsg1-4+deb11u2 for the bullseye distribution (Debian Security).