CVE-2020-35965: FFmpeg Buffer Overflow Vulnerability

CVE-2020-35965 Overview

CVE-2020-35965 is an out-of-bounds write vulnerability in FFmpeg 4.3.1, specifically within the decode_frame function in libavcodec/exr.c. The flaw arises from incorrect calculations that determine when to perform memset zero operations during EXR (OpenEXR) image decoding. This memory corruption vulnerability can be triggered by processing a specially crafted EXR file, potentially leading to denial of service conditions.

Critical Impact

Attackers can exploit this out-of-bounds write vulnerability by providing maliciously crafted EXR image files to applications using the vulnerable FFmpeg library, causing application crashes and denial of service.

Affected Products

• FFmpeg 4.3.1 and potentially earlier versions
• Debian Linux 9.0 (Stretch)
• Debian Linux 10.0 (Buster)

Discovery Timeline

• 2021-01-04 - CVE-2020-35965 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-35965

Vulnerability Analysis

The vulnerability exists in the EXR image decoder component of FFmpeg's libavcodec library. The decode_frame function in exr.c contains flawed logic for determining when memory initialization operations should occur. Specifically, the calculations controlling memset zero operations contain errors that can result in write operations occurring outside the bounds of allocated memory buffers.

When FFmpeg processes an EXR image file, the decoder must handle various image attributes and pixel data. The vulnerable code path incorrectly computes buffer boundaries, allowing an attacker-controlled input file to trigger memory writes past the intended buffer limits. This vulnerability was identified through fuzzing efforts and reported via the Chromium Issue #26532.

Root Cause

The root cause of CVE-2020-35965 is improper boundary condition checking in the EXR decoder's frame processing logic. The code responsible for zeroing out portions of the frame buffer uses incorrect offset or length calculations, which can be manipulated through specific values in a crafted EXR file header. This leads to the memset function writing beyond allocated heap memory, classified as CWE-787 (Out-of-bounds Write).

Attack Vector

The attack vector for this vulnerability is network-based, requiring no privileges or user interaction beyond the victim processing a malicious EXR file. An attacker could exploit this vulnerability through several scenarios:

1. Embedding a malicious EXR file on a web page where FFmpeg-based applications process images
2. Sending crafted EXR files via email or file sharing platforms
3. Uploading malicious content to media processing services that utilize FFmpeg

The vulnerability can be triggered when any application using the vulnerable FFmpeg library attempts to decode a specially crafted EXR image. The out-of-bounds write operation corrupts heap memory, which typically results in a crash (denial of service) and could potentially be leveraged for more severe exploitation depending on the memory layout and application context.

Detection Methods for CVE-2020-35965

Indicators of Compromise

• Unexpected application crashes when processing EXR image files
• Segmentation faults or memory access violations in FFmpeg-dependent applications
• Abnormal memory consumption patterns during media file processing
• Core dumps indicating heap corruption in libavcodec components

Detection Strategies

• Monitor for crashes in applications using FFmpeg with stack traces pointing to libavcodec/exr.c or the decode_frame function
• Implement file-type validation and sanitization for EXR files before processing
• Deploy application-level monitoring to detect unusual behavior during media decoding operations
• Use memory safety tools (AddressSanitizer, Valgrind) in development and testing environments to catch out-of-bounds writes

Monitoring Recommendations

• Enable crash reporting and centralized logging for media processing services
• Monitor system logs for segmentation faults in processes utilizing FFmpeg libraries
• Implement network traffic analysis to detect potentially malicious media file transfers
• Track FFmpeg version deployments across infrastructure to identify vulnerable installations

How to Mitigate CVE-2020-35965

Immediate Actions Required

• Update FFmpeg to a patched version that includes the security fixes
• Audit systems for applications and services that depend on FFmpeg for media processing
• Consider temporarily disabling EXR format support if not required for business operations
• Implement input validation to reject potentially malicious EXR files at application boundaries

Patch Information

FFmpeg has released patches to address this vulnerability. The fixes are available in the following commits:

• FFmpeg Commit Update #3e5959b
• FFmpeg Commit Update #b0a8b40

For Debian-based systems, security updates are available:

• Debian LTS Announcement
• Debian Security Advisory DSA-4990

Gentoo users should refer to Gentoo GLSA 2021-05-24 for update instructions.

Workarounds

• Disable EXR codec support in FFmpeg configuration if the format is not required
• Implement strict input file validation and reject files from untrusted sources
• Run FFmpeg-based processing in sandboxed environments with limited permissions
• Apply defense-in-depth measures including ASLR and stack canaries to mitigate exploitation impact

# Verify FFmpeg version and check for vulnerability
ffmpeg -version | head -n 1

# For Debian/Ubuntu systems, update FFmpeg packages
sudo apt update && sudo apt upgrade ffmpeg libavcodec58

# Rebuild FFmpeg without EXR support if not needed
./configure --disable-decoder=exr
make && make install