CVE-2024-47596: GHSL-2024-244: OOB-read in FOURCC_SMI_ parsing in GStreamer - CVE-2024-47596
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemuxparsesvq3stsddata function within qtdemux.c. In the FOURCCSMI case, seqhsize is read from the input file without proper validation. If seqhsize is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gstbufferfill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.22.0-5+deb12u2 - Upgrade
Upgrade
debian/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.24.10-1 - Upgrade
Upgrade
alpine/gst-plugins-goodto a version that resolves this vulnerability.Fixed in 1.24.10-r0 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.16.3-0ubuntu1.3 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.20.3-0ubuntu1.3 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.24.2-1ubuntu1.1 - Upgrade
Upgrade
debian/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.22.0-5+deb12u3Fixed in 1.22.0-5+deb12u4Fixed in 1.26.2-1+deb13u2Fixed in 1.28.9-1 - Upgrade
Upgrade
GStreamerto a version that resolves this vulnerability.Fixed in 1.24.10
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47596?
CVE-2024-47596 has been classified as a high severity vulnerability due to the potential for out-of-bounds read conditions.
How do I fix CVE-2024-47596?
To mitigate CVE-2024-47596, update GStreamer to version 1.24.11-5 or later if using the GStreamer-based packages.
Which versions of GStreamer are affected by CVE-2024-47596?
GStreamer versions prior to 1.24.11 and versions up to 1.18.4-2+deb11u2 of gst-plugins-good1.0 are affected by CVE-2024-47596.
What are the potential consequences of CVE-2024-47596?
Exploitation of CVE-2024-47596 could lead to information disclosure due to out-of-bounds reads.
Is there a patch available for CVE-2024-47596?
Yes, there is a patch available which addresses the vulnerability in the affected versions of GStreamer.