CVE-2022-41741: F5 Nginx DoS Vulnerability

CVE-2022-41741 Overview

CVE-2022-41741 is an out-of-bounds write vulnerability affecting the ngx_http_mp4_module in NGINX Open Source, NGINX Open Source Subscription, and NGINX Plus products. This memory corruption flaw allows a local attacker with the ability to upload or trigger processing of specially crafted audio or video files to corrupt NGINX worker memory, potentially resulting in worker process termination or other security impacts.

The vulnerability specifically affects NGINX deployments that have the ngx_http_mp4_module compiled and enabled, with the mp4 directive actively used in the configuration. Exploitation requires an attacker to be able to trigger processing of a malicious MP4 file through the affected module.

Critical Impact

Local attackers can corrupt NGINX worker memory through crafted MP4 files, potentially causing denial of service or enabling further exploitation of the web server infrastructure.

Affected Products

• F5 NGINX Open Source before versions 1.23.2 and 1.22.1
• F5 NGINX Open Source Subscription before versions R2 P1 and R1 P1
• F5 NGINX Plus before versions R27 P1 and R26 P1
• F5 NGINX Ingress Controller (various versions)
• Fedora 35, 36, and 37
• Debian Linux 10.0 and 11.0

Discovery Timeline

• October 19, 2022 - CVE-2022-41741 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-41741

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption issue within NGINX's MP4 streaming module. The ngx_http_mp4_module is responsible for pseudo-streaming server-side support for MP4 files, enabling efficient video delivery by allowing clients to start playback at arbitrary points in the video timeline.

When processing specially crafted audio or video files, the module fails to properly validate boundaries during memory operations, allowing data to be written outside allocated buffer regions. This out-of-bounds write can corrupt adjacent memory structures within the NGINX worker process, leading to unpredictable behavior including process crashes and potential code execution scenarios.

The vulnerability requires local access in the sense that an attacker must be able to supply a malicious MP4 file that gets processed by the vulnerable module. This could occur through file upload functionality, content delivery pipelines, or other mechanisms that allow external media files to be served through NGINX's MP4 streaming capabilities.

Root Cause

The root cause lies in improper boundary checking within the ngx_http_mp4_module when parsing MP4 container structures. MP4 files use a hierarchical atom/box structure to organize metadata and media data. The vulnerable code path fails to properly validate size fields and offsets when processing certain atoms, allowing crafted values to trigger memory writes beyond allocated buffer boundaries.

Attack Vector

The attack requires a local access vector where an attacker can influence the MP4 files processed by the vulnerable NGINX module. The attack flow proceeds as follows:

1. The attacker crafts a malicious MP4 file with manipulated atom size or offset values
2. The file is uploaded or otherwise made available to the NGINX server
3. A client request triggers the ngx_http_mp4_module to process the malicious file
4. The module's parsing logic encounters the malformed data
5. Insufficient boundary validation leads to out-of-bounds memory writes
6. NGINX worker memory is corrupted, causing termination or enabling further exploitation

The vulnerability does not require user interaction beyond the initial file processing trigger, and exploitation requires low privileges since the attacker needs only the ability to supply content to be processed.

Detection Methods for CVE-2022-41741

Indicators of Compromise

• Unexpected NGINX worker process crashes or restarts, particularly during MP4 file serving
• Error log entries indicating segmentation faults or memory corruption in worker processes
• Abnormal MP4 files with unusual atom structures or size values in upload directories
• Core dumps from NGINX workers showing corruption in ngx_http_mp4_module functions

Detection Strategies

• Monitor NGINX error logs for worker process crashes correlated with MP4 file requests
• Implement file integrity monitoring on uploaded media content directories
• Deploy runtime application self-protection (RASP) to detect memory corruption attempts
• Use intrusion detection systems with signatures for malformed MP4 file structures

Monitoring Recommendations

• Enable detailed NGINX error logging and centralize logs for analysis
• Set up alerting on NGINX worker process restart frequency thresholds
• Monitor system logs for segmentation fault signals from NGINX processes
• Track MP4 file upload patterns for anomalous file characteristics

How to Mitigate CVE-2022-41741

Immediate Actions Required

• Upgrade NGINX Open Source to version 1.23.2 or 1.22.1 or later
• Upgrade NGINX Plus to version R27 P1 or R26 P1 or later
• Upgrade NGINX Open Source Subscription to version R2 P1 or R1 P1 or later
• If immediate patching is not possible, disable the mp4 directive in configuration files

Patch Information

F5 has released security patches addressing this vulnerability. Detailed patch information and upgrade instructions are available in the F5 Support Article K81926432. Linux distributions including Debian and Fedora have also released updated packages. Refer to the Debian Security Advisory DSA-5281 and Debian LTS Announcement for distribution-specific updates.

Workarounds

• Remove or comment out mp4 directives from NGINX configuration files to disable the vulnerable module functionality
• Rebuild NGINX from source without the ngx_http_mp4_module if MP4 pseudo-streaming is not required
• Implement strict input validation on any file upload mechanisms that could supply MP4 files to NGINX
• Use a reverse proxy or WAF to filter requests for MP4 content until patching is complete

# Disable mp4 module in NGINX configuration
# Comment out or remove mp4 directives in affected location blocks

# Example: Original vulnerable configuration
# location /videos/ {
#     mp4;
#     mp4_buffer_size 1m;
#     mp4_max_buffer_size 5m;
# }

# Mitigated configuration - remove mp4 directive
location /videos/ {
    # mp4 directive removed to mitigate CVE-2022-41741
    # Serve files without MP4 pseudo-streaming
    root /var/www/media;
}

# Verify NGINX configuration syntax
nginx -t

# Reload NGINX to apply changes
systemctl reload nginx