OnlyPatch
Microsoft Windows Codecs Library

CVE-2021-33760 — Media Foundation Information Disclosure Vulnerability

Important CVSS 5.5 🔬 Patch diffed 2021-07 archive

Executive Summary

None

Overview

5.5
CVSS MEDIUM
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Information Disclosure
Released Jul 13 2021
Last Updated Jul 13 2021
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
NVD CVSS 5.5 MEDIUM — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
None
AVAILABILITY
None
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 4.8

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

14 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1909 for 32-bit Systems 5004245 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1909 for x64-based Systems 5004245 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1909 for ARM64-based Systems 5004245 (Security Update) Important Information Disclosure Yes
Windows Server, version 1909 (Server Core installation) 5004245 (Security Update) Important Information Disclosure Yes
Windows 10 Version 21H1 for x64-based Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 21H1 for ARM64-based Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 21H1 for 32-bit Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 2004 for 32-bit Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 2004 for ARM64-based Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 2004 for x64-based Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows Server, version 2004 (Server Core installation) 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 20H2 for 32-bit Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows 10 Version 20H2 for ARM64-based Systems 5004237 (Security Update) Important Information Disclosure Yes
Windows Server, version 20H2 (Server Core Installation) 5004237 (Security Update) Important Information Disclosure Yes

Patches

2 patches
Article Type Restart
5004245 Security Update Yes
5004237 Security Update Yes

Patch Diff

ghidriff · mfsrcsnk.dll ()

Integer overflow in mfsrcsnk.dll CMP3MediaSourcePlugin::ParseHeader when parsing MP3 headers. DoScanForFrameHeader's offset (0x38D7) is reused after DoReadFirstFrameBody returns without updating it, causing REMAINING_SZ to underflow (0x6F - 0x38D7 wraps unsigned). Large value passes size check, parser continues with invalid buffer pointer. CMPEGFrame::DeSerializeFrameHeader crashes reading freed heap. Trigger: navigate to folder containing malformed .mp3 file.

Pre-patch version 10.0.19041.746
Post-patch version 10.0.19041.906
Function Address Change Note
CMP3MediaSourcePlugin::ParseHeader code (offset reuse fix) Integer overflow: DoScanForFrameHeader stores large offset (0x38D7), DoReadFirstFrameBody returns without updating it. Second subtraction of REMAINING_SZ underflows (0x6F - 0x38D7 = 0xFFFFC798). Buffer pointer advances past valid memory, leading to OOB read in CMPEGFrame::DeSerializeFrameHeader.
CMPEGFrame::DeSerializeFrameHeader crash site Reads from invalid buffer pointer (r14) after the integer overflow in ParseHeader causes the buffer to point to freed heap memory. Access violation at mov ecx, [r14].
View RCA report Download PoC

Attack Path

Remote-ish DoS from a malformed MP3 - offset reuse underflows the remaining-size calculation in the shell property handler

Attack path for CVE-2021-33760 Remote-ish DoS from a malformed MP3 - offset reuse underflows the remaining-size calculation in the shell property handler 01 — ENTRY Victim browses a folder containing a malicious .mp3 file No click required - File Explorer builds the property store automatically via SHGetPropertyStoreFromParsingName. Works from a network share or a downloaded file. No privileges needed. 02 — CONTROLLED INPUT The MP3 carries a crafted frame header layout The attacker controls where DoScanForFrameHeader lands (offset 0x38D7) and the size fields the parser later subtracts against. 03 — PATH The shell property handler feeds the file into the MP3 source plugin InitializeFileHandlerWithStream -> CMFPropHandlerBase::Initialize -> CMFMP3PropertyHandler::InternalInitialize -> FeedBuffersToPlugin -> FeedNextBufferToPlugin -> CMP3MediaSourcePlugin::ParseHeader -> DoReadFrameHeader. 04 — MISSING CHECK The scan offset is reused after DoReadFirstFrameBody returns without updating it REMAINING_SZ is computed as 0x6F - 0x38D7, which wraps as unsigned to a huge value. The oversized result passes the subsequent size check, so parsing continues against an invalid buffer pointer. 05 — PRIMITIVE Out-of-bounds read of freed heap in DeSerializeFrameHeader CMPEGFrame::DeSerializeFrameHeader dereferences the bogus pointer. Reliable crash of the shell property host; exploitability beyond DoS is not demonstrated.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

jackery; Phan Thanh Duy, Brandon Chong, Cao YiTian of STAR Labs & Hồng Phi Phạm

On This Page