# Root Cause Analysis — CVE-2021-34503

## Metadata

| Field | Value |
|---|---|
| **CVE** | CVE-2021-34503 |
| **Binary** | mfmp4srcsnk.dll (Windows Media Foundation MP4/QT Source/Sink) |
| **Severity** | Important (CVSS 7.8) |
| **Impact** | Remote Code Execution (MSRC) / Information Disclosure |
| **Bug Class** | CWE-843: Type Confusion |
| **Patch** | July 2021 Patch Tuesday |
| **Discoverer** | Phan Thanh Duy (STAR Labs SG) |

## 1. Executive Summary

CVE-2021-34503 is a type confusion vulnerability in Windows Media Foundation's `mfmp4srcsnk.dll` when parsing QuickTime video file metadata. The `CQTSampleDescriptionAtom::FinalParseAtom` function iterates sample description objects and calls virtual functions without properly validating that all objects share the same type. A crafted `.mov` file with a mutated Protected Sample Entry Box causes a `CQTVideoSampleDescription` object (0x100 bytes) to be treated as a `CAVCVideoSampleDescription`, which accesses memory at offset 0x104 — past the allocation boundary.

## 2. Root Cause

### Type confusion in sample description array

`CQTSampleDescriptionAtom::FinalParseAtom` processes an array of sample description objects. When there are multiple entries (length > 1), it calls `CheckIfMultipleSampleEntriesAreAllowed` to verify type consistency. However, this check is insufficient — it fails to detect when objects of different concrete types (with different sizes) are mixed in the array.

### Vulnerable code path

```c
// CQTSampleDescriptionAtom::FinalParseAtom (simplified)
if (this->length > 1) {
    if (CheckIfMultipleSampleEntriesAreAllowed(this) < 0)
        return error;
}

this->a38 = 1;
for (v4 = 0; v4 < this->length; v4++) {
    // Calls vftable+0xB8 (IsBetterForMediaType) on each object
    v19 = (this->Array[v4]->vtable->IsBetterForMediaType)(
        this->Array[v4],
        this->Array[this->a38 - 1]);
    // ...
}
```

### The crash

`CAVCVideoSampleDescription::IsBetterForMediaType` accesses `[edi+0x104]`:

```asm
mov esi, dword ptr [edi+104h]  ; OOB read
```

But the object at `@edi` is actually a `CQTVideoSampleDescription` of size only 0x100, so offset 0x104 reads past the end of the heap allocation.

### Trigger mutation

The PoC file has the Protected Sample Entry Box FourCC mutated from `encv` to `ench`. This changes the parsing path in `CQTSampleDescriptionAtom::CreateChildAtom`, causing a `CQTVideoSampleDescription` (0x100 bytes) to be created instead of the expected `CAVCVideoSampleDescription` (larger allocation). When the array is later iterated with the AVC virtual function, the type confusion triggers the OOB access.

## 3. Reachability / Attack Surface

### Call chain

```
File Explorer browses folder / SHGetPropertyStoreFromParsingName
  -> windows_storage!CShellItem::GetPropertyStore
    -> windows_storage!CFSPropertyStoreFactory::_GetFileStore
      -> windows_storage!InitializeFileHandlerWithStream
        -> mfmp4srcsnk!CMFPropHandlerBase::Initialize
          -> mfmp4srcsnk!CMFMP4PropertyHandler::InternalInitialize
            -> mfmp4srcsnk!CMFMP4PropertyHandler::LoadMetadataProvider
              -> mfmp4srcsnk!MFCreateQTMovie
                -> mfmp4srcsnk!CQTMovie::CreateMovieFromBuffer
                  -> mfmp4srcsnk!CQTMovie::FinalParseAtom
                    -> mfmp4srcsnk!CQTSampleDescriptionAtom::FinalParseAtom
                      -> mfmp4srcsnk!CAVCVideoSampleDescription::IsBetterForMediaType  // CRASH
```

### Attack vectors

1. **File Explorer**: User navigates to a folder containing the malicious `.mov` file. Explorer's property handler automatically parses the file for metadata/thumbnail extraction.
2. **Internet Explorer / Edge (Legacy)**: User navigates to a page linking to the file.
3. **Programmatic**: Any application calling `SHGetPropertyStoreFromParsingName` on the file.

### Privilege required

None (user interaction: must navigate to folder).

## 4. Detection

### YARA rule

```yara
rule CVE_2021_34503_mfmp4srcsnk_type_confusion {
    meta:
        description = "Detects malformed QuickTime file exploiting CVE-2021-34503"
        cve = "CVE-2021-34503"
        author = "OnlyFm252"
    strings:
        $moov = "moov" ascii
        $trak = "trak" ascii
        $stbl = "stbl" ascii
        $stsd = "stsd" ascii
        $ench = "ench" ascii   // mutated from 'encv'
        $avc1 = "avc1" ascii
    condition:
        $moov and $trak and $stbl and $stsd and $ench and $avc1
}
```

### Sigma rule

```yaml
title: CVE-2021-34503 Media Foundation Type Confusion via Malformed QuickTime File
id: c7d8e3f1-2021-34503-mfmp4-tc
status: experimental
description: Detects mfmp4srcsnk.dll crashes indicative of CVE-2021-34503 exploitation
references:
    - https://starlabs.sg/advisories/21/21-34503/
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Data|contains: 'mfmp4srcsnk.dll'
    condition: selection
falsepositives:
    - Corrupted media files
level: medium
```

## 5. References

- STAR Labs advisory: https://starlabs.sg/advisories/21/21-34503/
- MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34503