Gstreamer CVE-2024-47598
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10.
AnalysisAI
An out-of-bounds read vulnerability exists in GStreamer's qtdemux component that allows reading 4 bytes beyond allocated memory boundaries when processing media files. The vulnerability affects GStreamer versions prior to 1.24.10 and can be exploited remotely without authentication to potentially expose sensitive information or cause application crashes. With a CVSS score of 9.1 and network-based attack vector, this represents a significant risk for applications using GStreamer for media processing, though no active exploitation or public proof-of-concept has been reported.
Technical ContextAI
GStreamer is a multimedia framework library used for constructing graphs of media-handling components, commonly employed in video players, streaming applications, and media processing tools. The vulnerability (CWE-125: Out-of-bounds Read) occurs in the qtdemux_merge_sample_table function within qtdemux.c, specifically when processing QuickTime/MP4 demuxing operations. The affected products are identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* for all versions prior to 1.24.10, where insufficient bounds checking on the stts (sample-to-time-sample) buffer allows reading of stts_duration values beyond the allocated memory region.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch and should be applied immediately for systems processing untrusted media content. For systems that cannot immediately upgrade, consider implementing input validation and sandboxing for media processing operations, restricting the processing of QuickTime/MP4 files from untrusted sources, or isolating GStreamer-based applications in controlled environments with limited access to sensitive data.
Share
External POC / Exploit Code
Leaving vuln.today