CVE-2021-45483

What it actually does

Use-after-free in WebCore::Frame::page causing memory corruption after a frame is released, different from CVE-2021-30889.

Why it matters to the business

Potential denial of service or code execution on systems processing untrusted web content; exploit code is publicly available and linked to Interlock ransomware campaigns, increasing urgency for organizations with high ecosystem prevalence of affected packages.

How an attack unfolds

An attacker delivers crafted web content or media that triggers the use-after-free condition in WebKitGTK; the freed object is reused to corrupt memory and achieve code execution, consistent with observed activity by Interlock ransomware and Apple WebKit exploit campaigns.

How to fix it

Upgrade to fixed versions: ffmpeg (Debian:11) 7:4.3.4-0+deb11u1, ffmpeg (Debian:12) 7:4.4.2-1, ffmpeg (Debian:13) 7:4.4.2-1, ffmpeg (Ubuntu:22.04:LTS) 7:4.4.2-0ubuntu0.22.04.1, ffmpeg/ffmpeg (GIT) d61977cbe453869cec28d32b71fe25c2cd965dcf. Apply patches immediately given public exploit maturity.

How to confirm the fix worked

Confirm package versions match or exceed the listed fixed releases; re-test rendering of previously crashing content and verify absence of the vulnerable Frame::page code path.

Typical attack path

1. Serve malicious HTML or media via web or local file
2. Trigger frame lifecycle that frees the object
3. Reuse dangling pointer for memory corruption
4. Escalate to arbitrary code execution or crash

How to detect it

Review web browser or media player logs for crashes involving WebCore::Frame, unusual memory access patterns, and any post-exploit artifacts associated with Interlock ransomware or Apple WebKit campaigns.

What your security team should do

• Prioritize patching all affected ffmpeg and WebKitGTK packages within the CISA-style remediation window
• Block untrusted web content and media until upgrades are complete
• Monitor threat intelligence for Interlock ransomware activity targeting this flaw