Gstreamer
CVE-2024-47537
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.
AnalysisAI
An integer overflow vulnerability in GStreamer's QuickTime demuxer leads to out-of-bounds memory writes when processing malicious media files with crafted sample count values. The vulnerability affects all GStreamer versions prior to 1.24.10 and allows remote attackers to achieve arbitrary code execution without authentication by serving specially crafted media files. With a critical CVSS score of 9.8 and network-based attack vector, this presents a severe risk for applications using GStreamer for media processing.
Technical ContextAI
GStreamer is a widely-used multimedia framework library for constructing graphs of media-handling components, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from CWE-190 (Integer Overflow or Wraparound) in the QuickTime demuxer component where the program attempts to reallocate memory for stream->samples based on untrusted input. When processing QuickTime files, the demuxer reads a samples_count value directly from the input file and adds it to stream->n_samples without proper bounds checking. If samples_count is sufficiently large, the addition operation overflows, causing g_try_renew to allocate far less memory than required. The subsequent loop then writes samples_count elements to this undersized buffer, resulting in heap corruption.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch and has been incorporated into the 1.24.10 release. For systems that cannot immediately upgrade, consider implementing input validation or sandboxing for any services that process untrusted media files with GStreamer. Organizations should review the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0005.html for additional details and ensure all GStreamer installations across their infrastructure are updated, particularly those exposed to untrusted input.
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today