CVE-2023-38103
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MDPR chunks. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21443.
Analysis
A critical integer overflow vulnerability exists in GStreamer's RealMedia file parser that allows remote code execution when processing specially crafted MDPR chunks. The vulnerability affects GStreamer version 1.22.3 and potentially earlier versions, enabling attackers to execute arbitrary code in the context of the current process through maliciously crafted RealMedia files. With an EPSS score of 4.54% (89th percentile), this vulnerability has a higher-than-average likelihood of exploitation in the wild, though it requires user interaction to trigger.
Technical Context
GStreamer is a widely-used open-source multimedia framework that processes various media formats including RealMedia files. The vulnerability (CWE-190: Integer Overflow or Wraparound) occurs specifically during the parsing of MDPR (Media Properties) chunks within RealMedia files, where insufficient validation of user-supplied size values can cause an integer overflow before buffer allocation. The affected product is identified through CPE as cpe:2.3:a:gstreamer:gstreamer:1.22.3:*:*:*:*:*:*:*, indicating the core GStreamer library is vulnerable. This type of vulnerability is particularly dangerous in media processing libraries as they commonly handle untrusted input from various sources including web content, streaming services, and local files.
Affected Products
GStreamer version 1.22.3 and potentially earlier versions are affected by this vulnerability, as confirmed by the CPE identifier cpe:2.3:a:gstreamer:gstreamer:1.22.3:*:*:*:*:*:*:*. GStreamer is commonly integrated into various Linux distributions, media players, web browsers, and streaming applications, making the impact widespread across multiple platforms and products. The vulnerability was originally reported to the Zero Day Initiative by [email protected] and assigned tracking number ZDI-CAN-21443 before receiving the CVE designation.
Remediation
Apply the official patch available from the GStreamer project at https://gitlab.freedesktop.org/gstreamer/gstreamer/uploads/d4a0aa4ec2165f6c418703b9e1459d8b/0002-rmdemux-Check-for-integer-overflow-when-calculation-.patch which adds proper integer overflow checks to the MDPR chunk parsing code. Organizations should update to the latest patched version of GStreamer as soon as possible. Until patching is complete, consider implementing network-level controls to block or inspect RealMedia files, restricting access to untrusted media sources, and educating users about the risks of opening media files from unknown sources. For additional details, refer to the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1007/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today