CVE-2024-47602
📋 TL;DR
A null pointer dereference vulnerability in GStreamer's matroska demuxer can cause application crashes when processing specially crafted media files. This affects any application using GStreamer to handle Matroska container files. The vulnerability allows denial of service attacks against media processing applications.
💻 Affected Systems
- GStreamer
- Applications using GStreamer library
📦 What is this software?
Gstreamer by Gstreamer Project
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to denial of service, potentially disrupting media processing services or applications that rely on GStreamer for media playback.
Likely Case
Application crash when processing malicious Matroska files, causing service disruption in media processing pipelines.
If Mitigated
No impact if patched version is used or if Matroska file processing is disabled.
🎯 Exploit Status
Exploitation requires the application to process a malicious Matroska file. No authentication needed if file processing is accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.24.10
Vendor Advisory: https://gstreamer.freedesktop.org/security/sa-2024-0019.html
Restart Required: Yes
Instructions:
1. Update GStreamer to version 1.24.10 or later. 2. For Linux distributions, use package manager: 'sudo apt update && sudo apt upgrade gstreamer1.0' (Debian/Ubuntu) or 'sudo yum update gstreamer' (RHEL/CentOS). 3. Restart applications using GStreamer.
🔧 Temporary Workarounds
Disable Matroska file processing
allConfigure applications to avoid processing Matroska (.mkv, .webm) files until patched.
Application-specific configuration required
🧯 If You Can't Patch
- Implement strict file upload validation to block Matroska files
- Use application firewalls or WAFs to detect and block malicious media file uploads
🔍 How to Verify
Check if Vulnerable:
Check GStreamer version: 'gst-inspect-1.0 --version' and verify if below 1.24.10Check Version:
gst-inspect-1.0 --versionVerify Fix Applied:
Confirm version is 1.24.10 or higher: 'gst-inspect-1.0 --version | grep -q "1.24.10" && echo "Patched"'📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults when processing media files
- Core dumps from GStreamer processes
Network Indicators:
- Unusual uploads of Matroska files to media processing services
SIEM Query:
Process:gst* AND (EventID:1000 OR Signal:SIGSEGV)