Gstreamer CVE-2024-47615
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.
AnalysisAI
A critical out-of-bounds write vulnerability exists in GStreamer's Vorbis parser that allows remote code execution by processing malicious media files. The flaw affects all GStreamer versions prior to 1.24.10 and enables attackers to overwrite up to 380 bytes of memory beyond array boundaries, potentially leading to arbitrary code execution without authentication. The vulnerability has been assigned a maximum CVSS score of 9.8, indicating critical severity with network-based exploitation possible.
Technical ContextAI
GStreamer is a widely-used multimedia framework library for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability resides in the gst_parse_vorbis_setup_packet function within vorbis_parse.c, where an integer size value is read from untrusted input without validation before being used as a loop counter. This classic CWE-787 (Out-of-bounds Write) occurs because the code fails to verify that the size parameter doesn't exceed the fixed 256-element pad->vorbis_mode_sizes array, resulting in memory corruption that extends 380 bytes past the array boundary when processing specially crafted Vorbis audio streams.
RemediationAI
Immediately upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038.patch and should be applied urgently given the critical severity. For systems that cannot be immediately patched, implement strict input validation for any Vorbis media files and consider disabling Vorbis codec support temporarily if feasible. Additionally, deploy network segmentation to limit exposure of systems running vulnerable GStreamer versions and monitor for unusual media processing activity or crashes that could indicate exploitation attempts.
Share
External POC / Exploit Code
Leaving vuln.today