CVE-2024-35368

What it actually does

Double free in rkmpp_retrieve_frame allows attacker-controlled memory corruption in the Rockchip MPP decoder path.

Why it matters to the business

Applications using FFmpeg for video decoding on Rockchip platforms face risk of crashes or remote code execution, potentially disrupting media pipelines and increasing exposure for systems that ingest untrusted video.

How an attack unfolds

An attacker supplies a specially crafted media file that exercises the rkmpp decoder; when FFmpeg processes the file the double-free occurs, enabling memory manipulation that can lead to arbitrary code execution.

How to fix it

Upgrade FFmpeg to commit 4513300989502090c4fd6560544dce399a8cd53c or later; rebuild with the corrected libavcodec/rkmppdec.c; consider disabling the rkmpp decoder at compile or runtime if hardware acceleration is not required.

How to confirm the fix worked

Confirm the presence of the fix commit in the source tree; run regression tests with known-triggering media files; verify that rkmpp_retrieve_frame no longer performs duplicate frees under AddressSanitizer or Valgrind.

Typical attack path

1. Craft malicious media file targeting rkmpp decoder
2. Deliver file to target application or service using FFmpeg
3. Trigger decoding via rkmpp_retrieve_frame
4. Exploit resulting double-free for memory corruption or code execution

How to detect it

Search application and system logs for FFmpeg segmentation faults or abort signals during media decoding; inspect core dumps for double-free patterns in rkmppdec.c frames; correlate with inbound untrusted media files.

What your security team should do

• Prioritize upgrade of all FFmpeg installations that enable the rkmpp decoder
• Inventory and restrict use of Rockchip hardware-accelerated decoding paths
• Add FFmpeg version checks to build and deployment pipelines
• Monitor for new exploit code targeting this double-free