Integer overflow in dav1d - CVE-2024-1580

Vulnerability identifier: #VU87785

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-1580

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the AV1 decoder when decoding videos with large frame size. A remote attacker can trick the victim to play a specially crafted video file, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

dav1d
Debian Linux
visionOS
Fedora
macOS
iPadOS
Apple iOS
openEuler
Anolis OS
Apple Safari
libdav1d-devel
libdav1d
dav1d-debugsource
dav1d-debuginfo
dav1d
dav1d (Debian package)
libavif0.10
libavif
xine-lib
dav1d-doc
libheif
vlc
ffmpeg
chromium

Install updates from vendor's website.

dav1d - update to 1.4.0
visionOS - update to 1.1.1
macOS - addressed in versions 13.6.6 22G630, 14.4.1 23E224
Apple Safari - update to 17.4.1
iPadOS - addressed in versions 16.7.7, 17.4.1 21E236
Apple iOS - addressed in versions 16.7.7 20H330, 17.4.1 21E236
libdav1d-devel - update to 0.5.2-4
libdav1d - update to 0.5.2-4
dav1d-debugsource - update to 0.5.2-4
dav1d-debuginfo - update to 0.5.2-4
dav1d - update to 0.5.2-4
dav1d (Debian package) - addressed in versions 0.7.1-3+deb11u1, 1.0.0-2+deb12u1
libavif0.10 - update to 0.10.1-2.el9
libavif - update to 0.11.1-5.el9
xine-lib - update to 1.2.13-4.el9
dav1d-doc - update to 1.4.0-1
libdav1d - update to 1.4.0-1
dav1d - update to 1.4.0-1
libdav1d-devel - update to 1.4.0-1
dav1d - addressed in versions 1.4.0-1.fc40, 1.5.0-2.el9
libheif - update to 1.16.1-2.el9
vlc - update to 3.0.21-9.el9
ffmpeg - update to 5.1.4-3.el9
chromium - update to 130.0.6723.116-1.el9

• https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
• https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/

• Remote code execution in VideoLAN dav1d
• Remote code execution in macOS Sonoma
• Remote code execution in macOS Ventura
• Remote code execution in Apple iOS 16 and iPadOS 16
• Remote code execution in Apple iOS 17 and iPadOS 17
• Fedora 40 update for dav1d
• Remote code execution in Apple visionOS
• Remote code execution in Apple Safari
• Debian update for dav1d
• Fedora EPEL 9 update for chromium, dav1d, ffmpeg, libavif, libavif0.10, libheif, vlc, xine-lib
• Anolis OS update for dav1d
• openEuler update for dav1d