Gstreamer CVE-2024-47776
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10.
AnalysisAI
An out-of-bounds read vulnerability exists in GStreamer's WAV file parser that allows remote attackers to crash applications or potentially leak sensitive memory contents when processing maliciously crafted WAV files. The vulnerability affects all GStreamer versions prior to 1.24.10 and can be triggered without authentication through network-accessible media processing applications. While no active exploitation has been observed in the wild (not in KEV), the vulnerability has a high CVSS score of 9.1 and detailed technical analysis is publicly available.
Technical ContextAI
GStreamer is a widely-used open-source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the gst_wavparse_cue_chunk function within gstwavparse.c, where a size calculation error allows reading beyond allocated buffer boundaries when parsing CUE chunks in WAV files. This is a classic CWE-125 out-of-bounds read vulnerability caused by improper validation of chunk sizes against available buffer data, specifically when the comparison 'if (size < 4 + ncues * 24)' fails due to upstream data size miscalculation during chunk clipping operations.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the official patch available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch. System administrators should prioritize updating media processing servers and applications that handle untrusted WAV files from external sources. As a temporary mitigation until patching is complete, consider implementing input validation to reject or sanitize WAV files before processing, or isolating media processing services in sandboxed environments to limit the impact of potential crashes or memory disclosure.
Share
External POC / Exploit Code
Leaving vuln.today