Gstreamer
CVE-2022-1924
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
AnalysisAI
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denial of service or potentially enable heap memory corruption when processing specially crafted MKV files with LZO compression. The vulnerability affects GStreamer versions prior to the patched releases and has been assigned a high CVSS score of 7.8, with proof-of-concept code publicly available. While the EPSS score indicates relatively low exploitation probability at 0.06%, the availability of public exploit code and the widespread use of GStreamer in multimedia applications makes this a significant concern for affected systems.
Technical ContextAI
The vulnerability resides in the matroskademux element of GStreamer, specifically in the LZO decompression function used when processing MKV container files. GStreamer is a widely-used open-source multimedia framework that provides a pipeline-based architecture for handling audio and video streams. The root cause is an integer overflow (CWE-122: Heap-based Buffer Overflow) that occurs during memory allocation calculations in the decompression routine. The impact varies depending on the underlying libc implementation and operating system capabilities - on systems where libc uses mmap for large memory allocations, the vulnerability typically results in a segmentation fault as the code attempts to write to unmapped memory. However, on systems without mmap support or using alternative libc implementations, the integer overflow can lead to heap memory corruption, potentially allowing attackers to overwrite adjacent heap structures.
RemediationAI
Apply the available security patches immediately by upgrading GStreamer to the latest patched version as documented in the GitLab issue at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225. Debian users should install the security updates provided in DSA-5204 (https://www.debian.org/security/2022/dsa-5204) for Debian 11, or the corresponding LTS updates (https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html) for Debian 10. As a temporary mitigation until patching is complete, consider implementing input validation to reject or quarantine MKV files using LZO compression, or process untrusted media files in isolated sandboxed environments to limit potential impact.
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault
An out-of-bounds write vulnerability exists in GStreamer's SSA subtitle parser (gstssaparse.c) that occurs when malforme
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today