CVE-2023-38104
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MDPR chunks. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21444.
Analysis
An integer overflow vulnerability in GStreamer's RealMedia file parsing functionality allows remote attackers to execute arbitrary code when processing malicious MDPR chunks. The vulnerability affects GStreamer version 1.22.3 and potentially earlier versions, requiring user interaction to trigger but potentially exploitable through various attack vectors depending on implementation. With an EPSS score of 4.97% (90th percentile), this vulnerability poses a significant exploitation risk and has patches available from the vendor.
Technical Context
GStreamer is a widely-used open-source multimedia framework that handles various media formats including RealMedia files. The vulnerability resides in the rmdemux component's MDPR (Media Properties Header) chunk parsing logic, where insufficient validation of user-supplied data leads to an integer overflow (CWE-190) before buffer allocation. This classic integer overflow pattern occurs when arithmetic operations on untrusted input values exceed the maximum value that can be stored in an integer type, causing the value to wrap around and potentially allocate a smaller buffer than intended, leading to heap corruption and code execution opportunities.
Affected Products
GStreamer version 1.22.3 is confirmed vulnerable according to the CPE identifier cpe:2.3:a:gstreamer:gstreamer:1.22.3:*:*:*:*:*:*:*, though earlier versions are likely also affected. The vulnerability specifically impacts the RealMedia demuxer component within GStreamer, which is used by numerous multimedia applications and frameworks that leverage GStreamer for media processing. The vendor has acknowledged the issue and provided patches through their GitLab repository at https://gitlab.freedesktop.org/gstreamer/gstreamer/.
Remediation
Apply the vendor-provided patch available at https://gitlab.freedesktop.org/gstreamer/gstreamer/uploads/d4a0aa4ec2165f6c418703b9e1459d8b/0002-rmdemux-Check-for-integer-overflow-when-calculation-.patch immediately, or upgrade to a patched version of GStreamer when released. As a temporary mitigation, disable or restrict processing of RealMedia files if feasible in your environment, and implement strict input validation for any media files processed through GStreamer. Organizations should also review the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1008/ for additional context.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today