CVE-2022-2122
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.
Analysis
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service or potentially execute arbitrary code through heap memory corruption. The vulnerability affects GStreamer versions prior to the patched releases and requires user interaction to process a malicious media file. A public proof-of-concept exploit is available, though the EPSS score indicates relatively low real-world exploitation probability at 0.06%.
Technical Context
The vulnerability resides in the qtdemux_inflate function within GStreamer's QuickTime demultiplexer (qtdemux) element, which handles zlib decompression of media data. The issue is classified as CWE-122 (Heap-based Buffer Overflow), where an integer overflow during decompression calculations can lead to incorrect memory allocation sizes. GStreamer is a widely-used multimedia framework that processes various media formats, and the qtdemux element specifically handles QuickTime/MP4 container formats. The behavior varies depending on the underlying libc implementation and operating system capabilities, ranging from a simple segmentation fault to a potentially exploitable heap overwrite condition.
Affected Products
GStreamer multimedia framework versions prior to the patched releases are affected, as identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. Debian Linux distributions are specifically impacted, including Debian 10 (Buster) and Debian 11 (Bullseye) as indicated by CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* and cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*. The vulnerability was reported by Red Hat's security team ([email protected]). Detailed version information and patches are available through Debian Security Advisory DSA-5204 at https://www.debian.org/security/2022/dsa-5204.
Remediation
Apply the security updates provided in Debian Security Advisory DSA-5204 (https://www.debian.org/security/2022/dsa-5204) for Debian 11, and the corresponding LTS announcement (https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html) for Debian 10. For other distributions, update GStreamer packages to versions that include the fix for issue #1225 as tracked at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225. As a temporary mitigation, restrict processing of untrusted media files and implement input validation for QuickTime/MP4 files where possible. Consider sandboxing applications that process media files to limit the impact of potential exploitation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today