CVE-2024-47598

12.12.2024, 02:03

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isnt properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub_M	CNA	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 32%

Vendor	Product	Version
gstreamer_project	gstreamer	𝑥 < 1.24.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

gst-plugins-good1.0

bullseye	vulnerable
bullseye (security)	1.18.4-2+deb11u3 fixed
bookworm	1.22.0-5+deb12u2 fixed
bookworm (security)	1.22.0-5+deb12u2 fixed
sid	1.26.1-1 fixed
trixie	1.26.1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

gst-plugins-good0.10

plucky	dne
oracular	dne
noble	dne
jammy	dne
focal	dne
xenial	needs-triage

gst-plugins-good1.0

plucky	not-affected
oracular	Fixed 1.24.8-1ubuntu1.1 released
noble	Fixed 1.24.2-1ubuntu1.1 released
jammy	Fixed 1.20.3-0ubuntu1.3 released
focal	Fixed 1.16.3-0ubuntu1.3 released
bionic	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch

https://gstreamer.freedesktop.org/security/sa-2024-0006.html

https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/