Memory Corruption in dav1d AV1 Decoder Due to Integer Overflow

CVE-2024-1580

5.9MEDIUM

Key Information

Vendor: Videolan
Status: Dav1d
Vendor: CVE Published:; 19 February 2024

Badges

📈 Trended📈 Score: 3,420👾 Exploit Exists📰 News Worthy

What is CVE-2024-1580?

CVE-2024-1580 is a critical vulnerability found in the dav1d AV1 decoder, a software component developed by Videolan for decoding AV1 video format. The vulnerability stems from an integer overflow that occurs when processing videos featuring large frame sizes. This memory corruption issue presents substantial risks to organizations utilizing this software, as it could potentially allow adversaries to execute arbitrary code, disrupt service, or manipulate video streams, thereby compromising the integrity and security of the systems relying on dav1d for media processing.

Technical Details

The vulnerability arises from an integer overflow during the decoding process within the dav1d AV1 decoder. Specifically, this flaw can be triggered when an unusually large video frame is decoded, leading to unexpected behavior through memory corruption. Technical investigations into this vulnerability recommend users to upgrade to versions beyond 1.4.0 of dav1d to ensure protection against this flaw. Prior versions are susceptible to exploitation due to this technical deficiency, suggesting the need for immediate remediation by affected users.

Impact of the Vulnerability

Arbitrary Code Execution: The most severe impact of CVE-2024-1580 is the potential for attackers to execute arbitrary code on affected systems. If successfully exploited, this could allow complete control over the compromised system, enabling unauthorized access to sensitive data and resources.
Service Disruption: Exploiting this vulnerability could lead to service outages or crashes of applications relying on the dav1d decoder, disrupting normal operations and affecting user experience.
Data Integrity Risks: The exploitation of this vulnerability poses risks to data integrity, as attackers could manipulate the video streams or data processed through the codec, leading to misinformation or compromised media content.