9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-6879

CVE-2023-6879: heap buffer overflow in libaom

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-6879

CVE-2023-6879:

9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly names av1_loop_restoration_dealloc() as the function where the heap overflow occurs. I was unable to fetch commit information using the get_commit_infos tool for either googlesource or GitHub URLs for the specified commit hash. However, by manually inspecting the commit 7cb3225030a95005953cb49fad097c97f157309a on aomedia.googlesource.com, which is referenced in relation to the CVE and the GHSA advisory, I analyzed the changes in av1/common/looprestoration.c. The patch modifies av1_loop_restoration_dealloc by adding assignments to zero out rinfo[p].stripe_data_capacity and rinfo[p].stripes_per_plane. This directly addresses the scenario where these fields could hold stale values after rinfo[p].stripes_storage is freed, which, upon resolution change, could lead to a heap overflow. The commit message "Fix heap OOB in av1_loop_restoration_dealloc" further confirms this. Therefore, av1_loop_restoration_dealloc is the vulnerable function as it lacked the necessary cleanup of metadata associated with the deallocated buffer, leading to potential out-of-bounds access when frame resolution changes.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.