CVE-2024-1580: Videolan Dav1d Buffer Overflow Vulnerability

CVE-2024-1580 Overview

CVE-2024-1580 is an integer overflow vulnerability in the dav1d AV1 decoder that occurs when decoding videos with large frame sizes. This vulnerability can lead to memory corruption within the AV1 decoder, potentially enabling attackers to execute arbitrary code or cause application crashes. The dav1d library is a widely-used, cross-platform AV1 decoder developed by VideoLAN that is integrated into numerous applications and operating systems, including Apple Safari, iOS, iPadOS, macOS, and visionOS.

Critical Impact

An attacker can craft a malicious AV1 video file that, when decoded, triggers an integer overflow leading to memory corruption. This could result in arbitrary code execution in the context of the application processing the video, affecting millions of devices across Apple's ecosystem and other platforms using the dav1d library.

Affected Products

• VideoLAN dav1d (versions prior to 1.4.0)
• Apple Safari
• Apple iPadOS
• Apple iPhone OS (iOS)
• Apple macOS
• Apple visionOS
• Fedora Project Fedora 40

Discovery Timeline

• February 19, 2024 - CVE-2024-1580 published to NVD
• March 2024 - Apple releases security patches addressing the vulnerability
• February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2024-1580

Vulnerability Analysis

This vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). The integer overflow occurs during the processing of video frames with exceptionally large dimensions. When the dav1d decoder calculates memory allocation sizes for frame buffers, the arithmetic operations can overflow if the frame dimensions exceed expected bounds, resulting in undersized buffer allocations. Subsequent operations then write beyond the allocated buffer boundaries, corrupting adjacent memory regions.

The vulnerability is particularly concerning due to the ubiquity of the dav1d decoder across major platforms. Since AV1 is becoming the standard codec for web video streaming, any application or browser capable of playing AV1 content could be affected. The network-accessible nature of the attack vector means that exploitation can occur simply by visiting a malicious website or opening a crafted video file.

Root Cause

The root cause is an integer overflow in the frame size calculation logic within the dav1d AV1 decoder. When processing video streams with unusually large frame dimensions, the multiplication or addition operations used to compute buffer sizes can wrap around to a small value due to integer overflow. This results in the allocation of an insufficient memory buffer, followed by out-of-bounds memory writes when the actual frame data is decoded into the undersized buffer.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious AV1 video file with specially constructed frame size parameters designed to trigger the integer overflow
2. Hosting the malicious video on a web server or embedding it in a webpage
3. Luring victims to access the content through a vulnerable browser or media player
4. When the victim's device attempts to decode the AV1 video, the integer overflow occurs, leading to memory corruption

The vulnerability manifests in the frame buffer allocation routine where large frame dimensions cause integer overflow during size calculations. When the decoder attempts to write frame data to the undersized buffer, memory corruption occurs. For detailed technical analysis, refer to the VLC dav1d Release Notes and the Full Disclosure threads.

Detection Methods for CVE-2024-1580

Indicators of Compromise

• Unusual application crashes when processing AV1 video content
• Memory access violation errors in processes using the dav1d library
• Unexpected memory consumption spikes during video playback
• Application crashes with heap corruption indicators

Detection Strategies

• Monitor for abnormal crashes in Safari, media players, or applications that process AV1 content
• Implement application-level monitoring for heap corruption and memory access violations
• Use endpoint detection and response (EDR) solutions to identify exploitation attempts through behavioral analysis
• Deploy network-based detection for suspicious AV1 video files with anomalous frame dimension headers

Monitoring Recommendations

• Enable crash reporting and analysis for applications using the dav1d decoder
• Monitor system logs for segmentation faults or memory corruption errors in video processing applications
• Implement file inspection policies for AV1 video content entering the network
• Configure SentinelOne to alert on suspicious memory access patterns in media decoder processes

How to Mitigate CVE-2024-1580

Immediate Actions Required

• Update dav1d to version 1.4.0 or later immediately
• Apply Apple security updates for iOS, iPadOS, macOS, Safari, and visionOS
• Update Fedora 40 systems with the latest security packages
• Consider temporarily disabling AV1 codec support in browsers and media players if patching is not immediately possible

Patch Information

The vulnerability has been addressed in dav1d version 1.4.0. VideoLAN has released the fix, which is available through the VLC dav1d Version 1.4.0 Release. Apple has addressed this vulnerability across its product line through multiple security updates documented in their support articles:

• Apple Support Article HT214093
• Apple Support Article HT214094
• Apple Support Article HT214095
• Apple Support Article HT214096
• Apple Support Article HT214097
• Apple Support Article HT214098

Fedora users should apply updates per the Fedora Package Announcement.

Workarounds

• Block or quarantine AV1 video content at network boundaries until systems are patched
• Disable automatic video playback in browsers and email clients
• Use application sandboxing to limit the impact of potential exploitation
• Implement strict content security policies to prevent loading of untrusted video content

# Verify dav1d version on Linux systems
dav1d --version
# Ensure version is 1.4.0 or later

# For Fedora systems, update using:
sudo dnf update dav1d

# Check Safari version on macOS (should include March 2024 security updates)
/Applications/Safari.app/Contents/MacOS/Safari --version