CVE-2024-22749: 
NixOS vulnerability analysis and mitigation

GPAC v2.3 contains a buffer overflow vulnerability in the gf_isom_new_generic_sample_description function located in isomedia/isom_write.c at line 4577. The vulnerability was discovered in January 2024 and affects the MP4Box component of GPAC (GitHub Issue, GitHub Advisory).

The vulnerability occurs due to an unsafe strcpy operation in the gf_isom_new_generic_sample_description function. When copying the compressor_name field, the function performs an unbounded string copy operation that can lead to a buffer overflow. The issue has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The buffer overflow vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service condition. The high CVSS score indicates that successful exploitation could result in a complete compromise of confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability can be triggered by processing specially crafted input files with the MP4Box utility. A proof of concept has been published demonstrating the exploitation through the -dash command line option. The attack requires local access and user interaction to process a malicious file (GitHub Issue).

Users should update to a version of GPAC that contains the fix for this vulnerability when available. The issue has been reported to the GPAC development team and is tracked in their issue system (GitHub Issue).