CVE-2024-5171: Aomedia Libaom Buffer Overflow Flaw

CVE-2024-5171 Overview

CVE-2024-5171 is an integer overflow vulnerability in the img_alloc_helper internal function of libaom, the reference implementation of the AV1 video codec maintained by the Alliance for Open Media (AOMedia). Attackers can trigger arithmetic overflows during buffer size and offset calculations by supplying large values for image dimensions or alignment parameters. The overflow causes the allocator to return an aom_image_t struct with invalid fields, enabling subsequent heap buffer overflows when the image data is processed.

The flaw is reachable through three public API entry points: aom_img_alloc(), aom_img_wrap(), and aom_img_alloc_with_border(). The vulnerability maps to CWE-190 (Integer Overflow or Wraparound) and CWE-20 (Improper Input Validation).

Critical Impact
Network-reachable integer overflow in a widely deployed AV1 codec library that can corrupt heap memory and enable arbitrary code execution in browsers, media players, and streaming services.

Affected Products

AOMedia libaom (all versions prior to the upstream fix)
Fedora distributions shipping vulnerable libaom builds
Debian LTS distributions shipping vulnerable libaom builds

Discovery Timeline

2024-06-05 - CVE-2024-5171 published to NVD
2024-09 - Debian LTS security announcement released
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5171

Vulnerability Analysis

The img_alloc_helper function computes the size of the backing image buffer and the offsets of its planes from caller-supplied parameters. When d_w, d_h, align, size_align, or border are large enough, the multiplications and additions used to derive these values exceed the range of the integer types involved. The results wrap around to small values, and the allocator reserves a buffer far smaller than the dimensions the caller requested.

The returned aom_image_t struct retains the attacker-influenced width, height, and stride fields. Any downstream code that writes pixel data based on those fields will write past the undersized heap allocation. This produces a heap buffer overflow that can corrupt adjacent heap metadata and object pointers.

Root Cause

The root cause is missing validation of arithmetic results during buffer sizing in img_alloc_helper. The function trusts caller-supplied dimensions and alignment values without bounds-checking the products and sums used to compute the allocation size. This is a classic [CWE-190] integer overflow leading to a too-small allocation.

Attack Vector

libaom is embedded in browsers (including Chromium-based products), streaming clients, video editors, and server-side transcoders. An attacker who can supply a crafted AV1 stream, container metadata, or API parameters to any application that calls these three APIs with untrusted dimensions can trigger the overflow remotely without authentication or user interaction. The Chromium issue report documents the browser-facing attack surface.

No verified proof-of-concept code is publicly available for this issue. Refer to the Debian LTS announcement and the Chromium bug tracker for technical context.

Detection Methods for CVE-2024-5171

Indicators of Compromise

Process crashes or heap corruption signatures in applications that decode or transcode AV1 content, such as browsers, ffmpeg-based pipelines, or media servers linked against libaom.
Unexpected child process creation or shellcode-like memory regions in processes hosting the libaom decoder.
Malformed AV1 bitstreams or container metadata advertising abnormally large frame dimensions or alignment values.

Detection Strategies

Inventory all binaries and containers that link against libaom and correlate versions against vendor advisories from Fedora and Debian.
Inspect AV1 inputs for header fields declaring extreme width, height, or border values that have no legitimate use case.
Enable heap hardening telemetry (AddressSanitizer in test environments, glibc MALLOC_CHECK_, or Windows page heap) to surface overflow attempts during fuzzing and QA.

Monitoring Recommendations

Monitor endpoints and media-processing servers for crashes in aom_img_alloc, aom_img_wrap, or aom_img_alloc_with_border stack frames.
Alert on outbound connections initiated by media renderer or decoder processes immediately after parsing untrusted AV1 content.
Track package versions of libaom across the fleet and flag hosts running builds that predate the upstream fix.

How to Mitigate CVE-2024-5171

Immediate Actions Required

Update libaom to a patched build from upstream AOMedia or apply the distribution updates announced by Fedora and Debian LTS.
Restart any long-running services that statically or dynamically link against libaom, including browsers, transcoders, and CDN edge workers.
Block or sanitize untrusted AV1 inputs at perimeter proxies until patches are deployed across the environment.

Patch Information

The AOMedia project corrected the buffer size calculations in img_alloc_helper upstream. Downstream packaging fixes are tracked in the Fedora package announcement, a second Fedora package announcement, and the Debian LTS announcement. Apply the package update appropriate for your distribution.

Workarounds

Disable AV1 decoding in applications that allow codec selection until libaom is updated.
Enforce upper bounds on d_w, d_h, align, size_align, and border in any wrapper code that calls aom_img_alloc(), aom_img_wrap(), or aom_img_alloc_with_border() with externally influenced parameters.
Run media decoders inside sandboxed or seccomp-restricted processes to limit the impact of heap corruption if exploited.

bash

# Example: update libaom on Debian-based systems
sudo apt-get update
sudo apt-get install --only-upgrade libaom0 libaom-dev

# Example: update libaom on Fedora
sudo dnf upgrade --refresh libaom