CVE-2021-3497
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
Analysis
A use-after-free vulnerability exists in GStreamer's Matroska demuxer that can be triggered when processing malformed video files, potentially allowing attackers to execute arbitrary code or cause application crashes. The vulnerability affects GStreamer versions before 1.18.4 and requires local access with user interaction to exploit. With an EPSS score of only 0.18% and no KEV listing, this vulnerability has low real-world exploitation probability despite its high CVSS score of 7.8.
Technical Context
GStreamer is a widely-used multimedia framework that provides libraries for handling audio and video streams across Linux and other platforms. The vulnerability occurs in the Matroska (MKV) file format demuxer component, where error handling code paths can access memory that has already been freed (CWE-416: Use After Free). This class of vulnerability occurs when a program continues to use a pointer after the memory it references has been deallocated, leading to unpredictable behavior including potential code execution. The affected CPE entries indicate this impacts GStreamer on Debian Linux 9.0 and 10.0, as well as Red Hat Enterprise Linux 7.0 and 8.0.
Affected Products
GStreamer versions prior to 1.18.4 are affected by this vulnerability, as confirmed by CPE entry cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability specifically impacts systems running Debian Linux 9.0 and 10.0, as well as Red Hat Enterprise Linux 7.0 and 8.0. Multiple Linux distributions have issued security advisories, including Debian (DSA-4900), Gentoo (GLSA-202208-31), and Red Hat (Bugzilla 1945339). The official GStreamer security advisory is available at https://gstreamer.freedesktop.org/security/sa-2021-0002.html.
Remediation
Upgrade GStreamer to version 1.18.4 or later, which contains the fix for this vulnerability. Patches are available from the vendor as noted in the Red Hat Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=1945339. For Debian users, apply the security updates referenced in DSA-4900 at https://www.debian.org/security/2021/dsa-4900. As a temporary mitigation until patching is complete, avoid processing untrusted or potentially malicious Matroska (MKV) files, and consider implementing sandboxing for media processing applications to limit the impact of potential exploitation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today