CVE-2024-6064: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in GPAC version 2.5-DEV-rev228-g11067ea92-master. The vulnerability affects the function xmt_node_end in the file src/scene_manager/loader_xmt.c of the MP4Box component. The issue requires local access to exploit (NVD).

The vulnerability is a heap-use-after-free issue that occurs in the xmt_resolve_od_links function at line 531 of loader_xmt.c. When processing XMT files, the code attempts to access memory after it has been freed, which can lead to program crashes or potential code execution. The issue has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub Issue).

The vulnerability can lead to program crashes and potential arbitrary code execution in the context of the MP4Box application. Since local access is required, the impact is limited to users who have access to the system running the vulnerable GPAC version (NVD).

A proof-of-concept exploit has been publicly disclosed and is available. The vulnerability can be triggered by processing specially crafted XMT files with the MP4Box application (GitHub Issue).

A patch has been released to address this vulnerability. The fix is available in commit c1b9c794bad8f262c56f3cf690567980d96662f5. Users are recommended to update to the patched version or apply the provided fix (GitHub Patch).