CVE-2022-1924
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
Analysis
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denial of service or potentially enable heap memory corruption when processing specially crafted MKV files with LZO compression. The vulnerability affects GStreamer versions prior to the patched releases and has been assigned a high CVSS score of 7.8, with proof-of-concept code publicly available. While the EPSS score indicates relatively low exploitation probability at 0.06%, the availability of public exploit code and the widespread use of GStreamer in multimedia applications makes this a significant concern for affected systems.
Technical Context
The vulnerability resides in the matroskademux element of GStreamer, specifically in the LZO decompression function used when processing MKV container files. GStreamer is a widely-used open-source multimedia framework that provides a pipeline-based architecture for handling audio and video streams. The root cause is an integer overflow (CWE-122: Heap-based Buffer Overflow) that occurs during memory allocation calculations in the decompression routine. The impact varies depending on the underlying libc implementation and operating system capabilities - on systems where libc uses mmap for large memory allocations, the vulnerability typically results in a segmentation fault as the code attempts to write to unmapped memory. However, on systems without mmap support or using alternative libc implementations, the integer overflow can lead to heap memory corruption, potentially allowing attackers to overwrite adjacent heap structures.
Affected Products
GStreamer multimedia framework versions prior to the security patches are affected, as indicated by the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability also impacts Debian Linux distributions, specifically Debian 10 (Buster) and Debian 11 (Bullseye) as shown by CPE identifiers cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* and cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*. Debian has released security updates DSA-5204 for stable releases and corresponding updates for the LTS branch as documented in their security advisories.
Remediation
Apply the available security patches immediately by upgrading GStreamer to the latest patched version as documented in the GitLab issue at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225. Debian users should install the security updates provided in DSA-5204 (https://www.debian.org/security/2022/dsa-5204) for Debian 11, or the corresponding LTS updates (https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html) for Debian 10. As a temporary mitigation until patching is complete, consider implementing input validation to reject or quarantine MKV files using LZO compression, or process untrusted media files in isolated sandboxed environments to limit potential impact.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today