Gstreamer CVE-2023-44446
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299.
AnalysisAI
A use-after-free vulnerability in GStreamer's MXF (Material Exchange Format) video file parser allows remote attackers to execute arbitrary code when processing specially crafted MXF files. The vulnerability affects all GStreamer installations and requires user interaction such as opening a malicious video file, with an EPSS score of 4.17% indicating moderate real-world exploitation likelihood. While not currently in CISA's KEV catalog, the vulnerability has a patch available and was discovered through responsible disclosure by the Zero Day Initiative.
Technical ContextAI
GStreamer is a widely-used open-source multimedia framework that provides a pipeline-based architecture for building media-handling components, affected across all versions as indicated by the CPE string cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from a use-after-free condition (CWE-416) in the MXF demuxer component, where the parser fails to properly validate object existence before performing operations on potentially freed memory. This memory corruption class of vulnerability occurs when code attempts to access memory that has already been deallocated, potentially allowing attackers to control the freed memory space and achieve code execution in the context of the application using GStreamer.
RemediationAI
Apply the vendor-provided patches detailed in GStreamer Security Advisory SA-2023-0010 available at https://gstreamer.freedesktop.org/security/sa-2023-0010.html, which contains fixes for the MXF parser use-after-free vulnerability. Until patching is complete, implement input validation to restrict processing of MXF files from untrusted sources and consider disabling MXF format support if not required for business operations. Organizations should also monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1647/ for any updates or additional technical details about the vulnerability.
Share
External POC / Exploit Code
Leaving vuln.today