CVE-2023-5998: 
NixOS vulnerability analysis and mitigation

CVE-2023-5998 is an Out-of-bounds Read vulnerability discovered in the GitHub repository gpac/gpac affecting versions prior to 2.3.0-DEV. The vulnerability was initially reported on November 7, 2023, and has been assigned a high severity rating with a CVSS v3.1 base score of 7.5 (NVD).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and affects the reframe_mpgvid component of the GPAC software. The issue occurs when processing packet sizes that exceed the available buffer space, potentially leading to memory access violations (GitHub Patch).

The vulnerability could lead to high availability impact, as indicated by the CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. While there is no direct impact on confidentiality or integrity, the out-of-bounds read condition could cause application crashes or denial of service (NVD).

A patch has been released that adds size checking to prevent the out-of-bounds read condition. Users should upgrade to GPAC version 2.3.0-DEV or later which includes the fix. The patch specifically adds validation to ensure packet sizes do not exceed the available buffer space (GitHub Patch).