Do modern computers prevent instructions being executed by audio? If so, how?

Question

Most know that early phones and modems, and still, fax machines, sent information through the use of tones. This got me thinking - could audio be a viable vector for executing instructions by a bad actor? (By this I mean the use of a carefully crafted audio file that when played could trick some part of the OS or underlying hardware to execute actual machine code)

I imagine there are means to prevent this (I hope), but I'm unable to find any specific documentation or examples of this being considered, nor any defenses being placed into software or hardware.

This is quite a theoretical question, mostly born out of curiosity, and something I was hoping to find a study on, with no luck.

Answer 1

It already exists and we can find the examples with CVE mpeg or CVE mp3, or searching some other formats. Three examples among the many;

• CVE-2014-2299
  Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data. Publish Date : 2014-03-11 Last Update Date : 2016-06-02

• CVE-2010-0480
  Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."

• CVE-2010-0818
  The MPEG-4 codec in the Windows Media codecs in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 does not properly handle crafted media content with MPEG-4 video encoding, which allows remote attackers to execute arbitrary code via a file in an unspecified "supported format," aka "MPEG-4 Codec Vulnerability."

Answer 2

Yes, it absolutely could, if the software that plays the audio has a vulnerability that allows that to happen.

I suggest learning about the nature of these vulnerabilities, to understand better how it can happen -- and then you will see that it can happen with any data, if the software that interprets the data has the right (wrong) sort of vulnerability. You might start by reading about buffer overrun vulnerabilities and code injection vulnerabilities.

Without a vulnerability, no, that won't happen.

Answer 3

I'm far from a expert hardware engineer but hardware like old phones transmit sound with a range of frequency that's translated by some oscillating circuit. It is dead hardware that doesn't do anything except transmit current that makes a small speaker vibrate at a specific frequency which create sound. It doesn't really execute instructions like a processor would.

Nowadays, you have complex microphones which capture sound. There are complex controllers in the microphones probably which execute instructions but not CPU ones.

For example, on x86-64, a USB microphone is polled by an xHC. The xHC polls the microphone until it has data. The xHC doesn't execute CPU instructions but it can write in RAM directly. This is definitely a vulnerability but is the kind of attack that would require having a combined control of the computer and to be in range of the microphone AND a vulnerability in the hardware controller (the xHC). The xHC does write in data but at the demand of software. Since it is DMA, if the xHC writes in RAM at some position where it shouldn't then, it is an attack vector. I have a hard time to understand why some sound vs other would trigger this kind of attack. I also doubt that there is such vulnerability in USB controllers.

The biggest threat is probably software. Software is audited a lot but is known to have lots of bugs and vulnerabilities. Software could overwrite some part of itself by triggering DMA writes for example. That could drastically change the behaviour of software and be an attack vector.

Don't get me wrong though. The question is "Do modern computers prevent instructions executed by audio? If so how?". The answer is they don't have to because audio isn't executing instructions. There is a lot of hardware in between and even this hardware is DMA so it doesn't execute instructions. It writes in RAM directly so this is the vulnerability not that "audio executes instructions".