CVE-2024-47540
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.
Analysis
An uninitialized stack variable vulnerability in GStreamer's Matroska demuxer leads to function pointer hijacking when processing malformed media files with specific size conditions. The vulnerability affects GStreamer versions prior to 1.24.10 and allows remote attackers to achieve arbitrary code execution without authentication by crafting malicious Matroska/WebM files. With a critical CVSS score of 9.8 and being tagged as RCE, this represents a severe risk for applications using GStreamer for media processing.
Technical Context
GStreamer is a widely-used open-source multimedia framework that constructs graphs of media-handling components for audio/video processing. The vulnerability occurs in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c when handling WavPack headers in Matroska container files. This is a classic CWE-457 (Use of Uninitialized Variable) vulnerability where a stack variable 'map' remains uninitialized when the size parameter is less than 4 bytes. The uninitialized map variable is then passed to gst_buffer_unmap, which attempts to dereference function pointers (mem->allocator->mem_unmap_full or mem->allocator->mem_unmap) from the uninitialized memory, allowing attackers to control execution flow. The affected product is identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* for versions before 1.24.10.
Affected Products
GStreamer versions prior to 1.24.10 are vulnerable to this uninitialized variable issue in the Matroska demuxer component, as confirmed by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability specifically affects the gst-plugins-good package which contains the Matroska demuxer. The issue has been acknowledged by the GStreamer project in their security advisory SA-2024-0017 available at https://gstreamer.freedesktop.org/security/sa-2024-0017.html. Debian has also issued security updates for their LTS distributions as noted in https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html.
Remediation
Upgrade GStreamer to version 1.24.10 or later which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch and should be applied immediately for systems processing untrusted media content. For systems that cannot be immediately upgraded, implement strict input validation on media files before processing, run GStreamer processes in sandboxed environments with minimal privileges, and consider disabling Matroska/WebM format support if not required. Monitor the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0017.html for additional updates.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today