CVE-2024-47778
📋 TL;DR
This CVE describes an out-of-bounds read vulnerability in GStreamer's WAV file parser that occurs when processing malformed ADTL chunks. Attackers can exploit this to read up to 4GB of process memory or cause segmentation faults. Any application using vulnerable GStreamer versions to parse WAV files is affected.
💻 Affected Systems
- GStreamer
📦 What is this software?
Gstreamer by Gstreamer Project
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive process memory (up to 4GB) or denial of service via application crash.
Likely Case
Application crash/denial of service when processing malicious WAV files.
If Mitigated
No impact if patched version is used or WAV parsing is disabled.
🎯 Exploit Status
Exploitation requires processing a malicious WAV file; no authentication needed for file processing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.24.10
Vendor Advisory: https://gstreamer.freedesktop.org/security/sa-2024-0027.html
Restart Required: Yes
Instructions:
1. Update GStreamer to version 1.24.10 or later
2. Restart all applications using GStreamer
3. Rebuild any applications statically linked to GStreamer
🔧 Temporary Workarounds
Disable WAV parsing
linuxRemove or disable gstwavparse plugin to prevent WAV file processing
mv /usr/lib/gstreamer-1.0/libgstwavparse.so /usr/lib/gstreamer-1.0/libgstwavparse.so.disabled
🧯 If You Can't Patch
- Implement strict file upload validation to reject suspicious WAV files
- Isolate GStreamer applications in containers with limited memory access
🔍 How to Verify
Check if Vulnerable:
Check GStreamer version: gst-inspect-1.0 --versionCheck Version:
gst-inspect-1.0 --versionVerify Fix Applied:
Verify version is 1.24.10 or higher: gst-inspect-1.0 --version | grep -q '1.24.10\|1.24.1[1-9]\|1.2[5-9]'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault (SEGV) errors in application logs
- Unexpected memory access patterns in system logs
Network Indicators:
- Unusual WAV file uploads to media processing services
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "SIGSEGV") AND process="*gstreamer*"