CVE-2024-47542
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Description
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation, resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.
Analysis
A null pointer dereference vulnerability exists in the GStreamer multimedia framework's ID3v2 tag parsing functionality, specifically in the id3v2_read_synch_uint function. The vulnerability allows remote attackers to cause a Denial of Service (DoS) through a segmentation fault without requiring authentication or user interaction. A public proof-of-concept exploit is available from GitHub Security Lab (GHSL-2024-235), though EPSS scoring indicates only a 0.08% probability of active exploitation in the wild (23rd percentile).
Technical Context
GStreamer (cpe:2.3:a:gstreamer:gstreamer) is a widely-used open-source multimedia framework for constructing media processing pipelines across Linux and embedded systems. This vulnerability manifests as CWE-125 (Out-of-bounds Read) in the ID3v2 metadata parsing code within id3v2.c. The id3v2_read_synch_uint function fails to validate that work->hdr.frame_data is non-null before dereferencing it to populate the data pointer, causing the process to attempt reading from address zero. ID3v2 is a metadata container format commonly embedded in MP3 and other audio files, making this vulnerability triggerable through malformed media file processing.
Affected Products
GStreamer versions prior to 1.24.10 are affected by this vulnerability, as confirmed via CPE identifier cpe:2.3:a:gstreamer:gstreamer. The vendor advisory is available at https://gstreamer.freedesktop.org/security/sa-2024-0008.html. Debian LTS distributions are also impacted, with a security update announced at https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html. Any application or system using vulnerable GStreamer versions for media processing, particularly those handling ID3v2-tagged audio files from untrusted sources, should be considered affected.
Remediation
Upgrade GStreamer to version 1.24.10 or later as documented in the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0008.html. The fix is available via merge request at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8033.patch. Debian LTS users should apply updates per https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html. Until patching is completed, implement defense-in-depth by sanitizing or validating media files from untrusted sources before processing, running GStreamer pipelines in sandboxed environments with resource limits, and restricting network access to media processing services to trusted sources only.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today