CVE-2024-47597
📋 TL;DR
This CVE describes an out-of-bounds read vulnerability in GStreamer's qtdemux component when parsing MP4 files. Attackers can craft malicious MP4 files that cause the application to read up to 8 bytes beyond allocated memory boundaries. This affects any application using vulnerable versions of GStreamer for media processing.
💻 Affected Systems
- GStreamer
- Applications using GStreamer library
📦 What is this software?
Gstreamer by Gstreamer Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the OOB-read can be leveraged for memory corruption attacks.
Likely Case
Application crash (denial of service) or information disclosure through memory leaks.
If Mitigated
Limited impact with proper sandboxing and memory protection mechanisms in place.
🎯 Exploit Status
Proof-of-concept crash file (GHSL-2024-245_crash1.mp4) is publicly available. Exploitation requires processing a malicious MP4 file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.24.10
Vendor Advisory: https://gstreamer.freedesktop.org/security/sa-2024-0012.html
Restart Required: Yes
Instructions:
1. Update GStreamer to version 1.24.10 or later. 2. Restart all applications using GStreamer. 3. For Linux distributions, use package manager: 'sudo apt update && sudo apt upgrade gstreamer1.0' (Debian/Ubuntu) or equivalent for your distribution.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict validation of MP4 files before processing with GStreamer
Sandbox media processing
linuxRun GStreamer in a container or sandbox with limited privileges
docker run --security-opt=no-new-privileges -v /path/to/media:/media gstreamer-app
🧯 If You Can't Patch
- Implement network filtering to block malicious MP4 files at perimeter
- Disable MP4 processing in affected applications if not required
🔍 How to Verify
Check if Vulnerable:
Check GStreamer version: 'gst-inspect-1.0 --version' and compare against 1.24.10Check Version:
gst-inspect-1.0 --version | head -1Verify Fix Applied:
Verify version is 1.24.10 or later and test with known malicious MP4 file (GHSL-2024-245_crash1.mp4) to ensure no crash📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory access violation errors in system logs
- GStreamer process termination with signal 11 (SIGSEGV)
Network Indicators:
- Unusual MP4 file uploads to media processing endpoints
- Large volumes of malformed media files
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "SIGSEGV" OR "memory violation") AND process="gst*"