Ubuntu issues USN-8771-1 and USN-8772-1 fixing Valkey and libaom vulnerabilities

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

Valkey, the Linux Foundation's Redis-compatible distributed key-value database, contains a use-after-free (CWE-416) in its tlsProcessPendingData function on servers with TLS enabled. While that function iterates the TLS pending-data list, an authenticated client can issue CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and triggering the memory-safety error. An attacker with low-privileged authenticated access can crash the server (denial of service) and potentially achieve remote code execution. All Valkey deployments on the 7.2, 8.0, 8.1, 9.0, and 9.1 branches prior to the fixed releases are affected, but only when TLS is enabled. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS estimates roughly a 0.5% chance of exploitation in the next 30 days, and Ubuntu has shipped fixes in USN-8771-1.

Do: Upgrade Valkey to 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 depending on your branch, and apply Ubuntu's USN-8771-1 update if running the distro package. Until patched, restrict network access to the server, enforce strong authentication/ACLs so only trusted clients can connect, and limit or monitor use of CLIENT KILL, since triggering the bug requires an authenticated client. Verify whether your deployment runs with TLS enabled, as non-TLS instances are not affected.

Valkey, the Linux Foundation's open-source distributed key-value database and Redis fork, contains a use-after-free (CWE-416) in its processing of the RESTORE command. An authenticated client can supply a malformed RDB stream payload that, during stream consumer-group deserialization, assigns a single Pending Entry List NACK to multiple consumers; when one of those consumers is deleted while another still references the shared NACK, freed memory is reused, which can corrupt the server and potentially allows remote code execution. A successful attacker gains code execution on the Valkey server host with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8, network vector, low privileges required, no user interaction). All deployments running Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 are affected, including downstream distribution packages such as Ubuntu's valkey, for which Canonical issued USN-8771-1. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.9% probability of exploitation within 30 days.

Do: Upgrade Valkey to version 7.2.14, 8.0.10, 8.1.9, 9.0.5, or 9.1.1 depending on your release branch; Ubuntu users should apply the update from USN-8771-1. Because exploitation requires an authenticated client connection, restrict network access to the Valkey port, enforce authentication/ACLs, and limit which clients can issue RESTORE. Check running instances via the server banner or INFO command to confirm they are on a fixed version.