CVE-2023-6604

What it actually does

The flaw permits demuxing of arbitrary unvalidated data as XBIN format in FFmpeg, resulting in excessive CPU load and storage consumption that can degrade performance or cause denial of service.

Why it matters to the business

Degraded performance or denial of service across systems using the affected components, impacting 83,123 downstream dependents with potential operational slowdowns or outages.

How an attack unfolds

An attacker supplies crafted data that FFmpeg processes without format validation as XBIN content, exhausting CPU and storage resources.

How to fix it

Upgrade tar (Ubuntu:14.04:LTS) to 1.27.1-1ubuntu0.1 and tar (Ubuntu:16.04:LTS) to 1.28-2.1ubuntu0.1 in all affected deployments.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases and test demuxing behavior with sample inputs to ensure validation is enforced.

Typical attack path

1. Identify target systems processing media with FFmpeg
2. Craft input data mimicking XBIN format without valid structure
3. Deliver data to the demuxer via supported input channels
4. Trigger resource exhaustion leading to degraded service

How to detect it

Inspect process logs and resource metrics for FFmpeg instances showing sustained high CPU or storage growth during demux operations; correlate with input file handling events.

What your security team should do

• Apply the specified package updates immediately given the large ecosystem prevalence
• Monitor systems for unexpected CPU and storage spikes during media processing
• Review input handling pipelines to add format validation where possible