REDHAT-BUG-2487614: Medium severity GStreamer GStreamer RealMedia demuxer (rmdemux) vulnerability
GStreamer RealMedia demuxer FILEINFO metadata OOB read. In gstrmdemuxparsemdpr(), the FILEINFO parsing loop (while elementnb) advances offset using reskippascalstring() without bounds checking. reskippascalstring() reads a length byte at the current offset and returns offset + 1 + length without validating the buffer boundary. elementnb is attacker-controlled and stored as signed int; value 0xFFFFFFFF causes infinite loop. No fix available; upstream recommends rmdemux rewrite. Reported via PSIRTSUPT-7239 by Tianshuo Han.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the GStreamer RealMedia demuxer FILEINFO metadata out-of-bounds read by isolating or disabling the RealMedia demuxing functionality (rmdemux) in affected deployments, since no fix is available and upstream recommends a rmdemux rewrite (PSIRTSUPT-7239).
- Compensating control
Apply an external control to prevent untrusted/attacker-controlled RealMedia (e.g., .rm/.rmvb) content from reaching the vulnerable GStreamer rmdemux code path (FILEINFO parsing in gst_rmdemux_parse_mdpr()).
- Compensating control
Reduce exposure to the infinite-loop condition caused by attacker-controlled element_nb stored as a signed int: block or limit RealMedia inputs that can trigger gst_rmdemux_parse_mdpr() FILEINFO parsing, since element_nb value 0xFFFFFFFF can cause an infinite loop.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487614?
The severity of REDHAT-BUG-2487614 is classified as medium (4).
What type of attack does REDHAT-BUG-2487614 facilitate?
REDHAT-BUG-2487614 could potentially allow for an out-of-bounds read vulnerability within the GStreamer RealMedia demuxer.
How do I fix REDHAT-BUG-2487614?
To fix REDHAT-BUG-2487614, update to the latest version of GStreamer that contains the security patch addressing this vulnerability.
Which software is affected by REDHAT-BUG-2487614?
REDHAT-BUG-2487614 affects the GStreamer RealMedia demuxer (rmdemux).
What is the nature of the vulnerability in REDHAT-BUG-2487614?
The nature of the vulnerability in REDHAT-BUG-2487614 is an out-of-bounds read caused by a lack of bounds checking in the parsing loop.