SonicWall Security Center
Share: Linkedin Share Facebook Like
Back to SonicALERT

Playing Media Files Can Lead to Remote Code Execution in Linux


A new 0-day vulnerability in Linux desktops was recently reported. This is due to a flaw in game-music-emu. Game-music-emu is a plugin that allows emulation of various CPU and audio processors, thereby letting a user play different kind of music files. The flaw is in the way game-music-emu emulates the SNES CPU and audio processor. A specially crafted SNES music file allows an attacker to execute remote code onto the system.

An analysis of the available POC samples is as follows:

By itself, the above code has been shown to cause the emulator to crash. This is caused by attempting to write to a location outside of the available memory.

The problem shown in the POCs is that the emulator does not have out-of-bounds checking for very large or negative values.

An attacker can thus create a specially crafted SNES music file and rename it either as .flac or .mp3 to entice an unsuspecting user to load the file onto a player that uses the gstreamer framework. Game-music-emu is part of a plugin that can be added to the gstreamer framework.

SonicWALL Threat Research Team has written the following signature to help protect our customers from this attack:

  • SPY 1074: Malformed-File spc.OT.1

Back to top

Back to SonicALERT

Follow: Follow us on Facebook Follow us on Twitter Join the Conversation
© 2021 SonicWall | Privacy Policy | Conditions for use | Feedback | Live Demo | SonicALERT | Document Library | Report Issues
Version: 17.3 | S1MSW04