CVE-2024-47543
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.
Analysis
An out-of-bounds read vulnerability exists in GStreamer's QuickTime demuxer (qtdemux.c) that allows attackers to read up to 4GB of process memory or trigger a denial of service via crafted media files. GStreamer versions prior to 1.24.10 are affected. With an EPSS score of only 0.08% (24th percentile), active exploitation appears unlikely despite the network-accessible attack vector and lack of required privileges.
Technical Context
GStreamer is a widely-used multimedia framework for constructing media processing pipelines. The vulnerability (CWE-125: Out-of-bounds Read) occurs in the qtdemux_parse_container function within the QuickTime demuxer component. The parent function qtdemux_parse_node fails to properly validate the length parameter before calculating buffer boundaries, causing the 'end' pointer to extend beyond the allocated buffer. When qtdemux_parse_container subsequently iterates through the buffer in a while loop, it can read memory outside the intended bounds. This affects cpe:2.3:a:gstreamer:gstreamer versions prior to 1.24.10, impacting any application or system utilizing GStreamer for QuickTime/MOV file parsing.
Affected Products
GStreamer versions prior to 1.24.10 are affected by this vulnerability, as confirmed via CPE identifier cpe:2.3:a:gstreamer:gstreamer. The vulnerability specifically impacts the QuickTime demuxer component used for parsing MOV and related container formats. Debian systems are also affected, as documented in the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. The official vendor security advisory is available at https://gstreamer.freedesktop.org/security/sa-2024-0009.html, and the GitHub Security Lab has published detailed analysis at https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/.
Remediation
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available in merge request 8059 at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch for those who need to backport the fix. Debian users should apply security updates as detailed at https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. For systems where immediate patching is not feasible, implement defense-in-depth controls such as restricting media file processing to trusted sources only, running GStreamer components in sandboxed environments with limited memory access, and implementing strict input validation before passing files to the demuxer. Consult the official vendor advisory at https://gstreamer.freedesktop.org/security/sa-2024-0009.html for additional guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today