# Root Cause Analysis — CVE-2021-33760

## Metadata

| Field | Value |
|---|---|
| **CVE** | CVE-2021-33760 |
| **Binary** | mfsrcsnk.dll (Windows Media Foundation Source/Sink) |
| **Severity** | Important |
| **Impact** | Information Disclosure |
| **Bug Class** | CWE-190: Integer Overflow → Use-After-Free / OOB Read |
| **Patch** | July 2021 Patch Tuesday |
| **Discoverers** | Phan Thanh Duy, Brandon Chong, Cao Yi Tian (STAR Labs SG) |

## 1. Executive Summary

CVE-2021-33760 is an integer overflow in `mfsrcsnk.dll` MP3 header parsing that results in an out-of-bounds read on freed heap memory. The `CMP3MediaSourcePlugin::ParseHeader` function incorrectly subtracts a stale offset from the remaining buffer size, causing an unsigned integer wrap. The large resulting value passes a size comparison check, and the parser continues to dereference a buffer pointer that has already been freed (CID3 frame destructor), leading to access of invalid heap memory.

## 2. Root Cause

### Integer overflow in remaining size calculation

In `CMP3MediaSourcePlugin::ParseHeader`:

1. `DoScanForFrameHeader` stores an offset (e.g., `0x38D7`) at `[rbp-0x19]`
2. First update: `REMAINING_SZ -= OOB_OFFSET` → `0x3946 - 0x38D7 = 0x6F` (correct)
3. `DoReadFirstFrameBody` is called but returns 0 **without updating** `OOB_OFFSET` (still `0x38D7`)
4. Second update: `REMAINING_SZ -= OOB_OFFSET` → `0x6F - 0x38D7 = 0xFFFFC798` (unsigned underflow)
5. Size check: `if (REMAINING_SZ < bytes_required)` — unsigned comparison, so `0xFFFFC798 > required` → check passes

### Use-after-free via stale buffer pointer

Between steps 2 and 4, `CID3Header::ReadFrames` processes ID3 frames. During this processing, `CMP3Base::Release` is called, which invokes `CID3Frame`'s vector deleting destructor, freeing the frame data. However, the `MFBuffer` pointer still references this freed memory region.

When `CMPEGFrame::DeSerializeFrameHeader` attempts to read from `MFBuffer` (`mov ecx, dword ptr [r14]`), `r14` points to the freed/invalid heap location, causing an access violation.

### Pseudocode

```c
// CMP3MediaSourcePlugin::ParseHeader (simplified)
v11 = DoScanForFrameHeader(&OOB_OFFSET);  // OOB_OFFSET = 0x38D7
REMAINING_SZ -= OOB_OFFSET;               // 0x3946 - 0x38D7 = 0x6F
MFBuffer += OOB_OFFSET;

// ... ID3 header processing frees some buffers ...

v32 = DoReadFirstFrameBody(BUF, REMAINING_SZ, &OOB_OFFSET);
// Returns 0, OOB_OFFSET NOT updated (still 0x38D7)

REMAINING_SZ -= OOB_OFFSET;  // 0x6F - 0x38D7 = 0xFFFFC798 (UNDERFLOW!)
MFBuffer += OOB_OFFSET;      // Points past valid memory

if (REMAINING_SZ < required) { ... }  // Check passes (0xFFFFC798 >> required)

// Later:
DoReadFrameHeader();
  -> CMPEGFrame::DeSerializeFrameHeader
    -> mov ecx, [r14]   // r14 = invalid MFBuffer -> ACCESS VIOLATION
```

## 3. Reachability / Attack Surface

### Call chain

```
File Explorer browses folder / SHGetPropertyStoreFromParsingName
  -> windows_storage!InitializeFileHandlerWithStream
    -> mfsrcsnk!CMFPropHandlerBase::Initialize
      -> mfsrcsnk!CMFMP3PropertyHandler::InternalInitialize
        -> mfsrcsnk!CMFMP3PropertyHandler::FeedBuffersToPlugin
          -> mfsrcsnk!CMFMP3PropertyHandler::FeedNextBufferToPlugin
            -> mfsrcsnk!CMP3MediaSourcePlugin::ParseHeader
              -> mfsrcsnk!CMP3MediaSourcePlugin::DoReadFrameHeader
                -> mfsrcsnk!CMPEGFrame::DeSerializeFrameHeader  // CRASH
```

### Attack vectors

1. **File Explorer**: Navigate to folder containing malicious `.mp3` file — metadata property handler triggers automatically
2. **Programmatic**: Call `SHGetPropertyStoreFromParsingName` on the file path

### Privilege required

None (user interaction: navigate to folder containing crafted file).

## 4. Detection

### YARA rule

```yara
rule CVE_2021_33760_mfsrcsnk_mp3_oob {
    meta:
        description = "Detects malformed MP3 files that may exploit CVE-2021-33760"
        cve = "CVE-2021-33760"
        author = "OnlyFm252"
    strings:
        $id3 = "ID3" ascii
        $mp3_sync = { FF FB }
        $mp3_sync2 = { FF FA }
    condition:
        $id3 at 0 and
        filesize < 100KB and
        (#mp3_sync + #mp3_sync2 > 50)
}
```

### Sigma rule

```yaml
title: CVE-2021-33760 Media Foundation MP3 Parser Integer Overflow
id: b8c9d4e2-2021-33760-mfsrcsnk-intovf
status: experimental
description: Detects mfsrcsnk.dll crash when parsing malformed MP3 files
references:
    - https://starlabs.sg/advisories/21/21-33760/
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Data|contains: 'mfsrcsnk.dll'
    condition: selection
falsepositives:
    - Corrupted MP3 files
level: medium
```

## 5. References

- STAR Labs advisory: https://starlabs.sg/advisories/21/21-33760/
- MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33760