CVE-2024-47613: GStreamer Null Pointer Dereference DoS

CVE-2024-47613 Overview

A null pointer dereference vulnerability has been discovered in GStreamer, the widely-used open-source multimedia framework for constructing graphs of media-handling components. The vulnerability exists in the gst_gdk_pixbuf_dec_flush function within gstgdkpixbufdec.c. When processing certain media files, the function invokes memcpy using out_pix as the destination address, which is expected to point to frame 0 from the frame structure read from the input file. However, under specific conditions, out_pix can reference a NULL frame, causing memcpy to attempt writing to address 0x00 and triggering a segmentation fault.

Critical Impact

This vulnerability enables attackers to cause a Denial of Service (DoS) condition by crashing applications that use the GStreamer GDK Pixbuf decoder plugin when processing maliciously crafted media files.

Affected Products

• GStreamer versions prior to 1.24.10
• Applications and systems using the GStreamer GDK Pixbuf decoder plugin (gstgdkpixbufdec.c)
• Linux distributions shipping vulnerable GStreamer packages

Discovery Timeline

• 2024-12-12 - CVE-2024-47613 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2024-47613

Vulnerability Analysis

This vulnerability is classified under CWE-476 (NULL Pointer Dereference) and CWE-787 (Out-of-bounds Write). The flaw occurs in the GDK Pixbuf decoder component of GStreamer, which is responsible for handling image data within media streams.

The vulnerable function gst_gdk_pixbuf_dec_flush processes frame data from input media files. During normal operation, the function expects out_pix to contain a valid pointer to frame 0's buffer. However, insufficient validation allows out_pix to be dereferenced when it contains a NULL value. When this occurs, the subsequent memcpy operation attempts to write data to memory address 0x00, which is a protected memory region on most systems, causing an immediate segmentation fault and process termination.

The local attack vector requires an attacker to provide a specially crafted media file to an application using the vulnerable GStreamer component. This could occur through various scenarios including media players opening malicious files, web browsers processing embedded media, or automated media processing pipelines.

Root Cause

The root cause of this vulnerability is inadequate input validation and null pointer checking in the gst_gdk_pixbuf_dec_flush function. The code fails to verify that out_pix contains a valid, non-NULL pointer before passing it to memcpy. When the input file contains malformed or unexpected frame data that results in a NULL frame reference, the code proceeds with the memory copy operation without checking for this condition.

Attack Vector

Exploitation of this vulnerability requires local access to provide a maliciously crafted media file to an application using GStreamer's GDK Pixbuf decoder. An attacker could:

1. Create a specially crafted media file designed to trigger the NULL frame condition
2. Deliver the malicious file to the target system through various means (email attachment, web download, shared storage)
3. When the victim opens or processes the file with a GStreamer-based application, the null pointer dereference occurs
4. The application crashes with a segmentation fault, resulting in denial of service

The vulnerability does not require user privileges for exploitation, as any user with access to process media files can trigger the condition. Applications that automatically process uploaded or received media files are particularly at risk.

Detection Methods for CVE-2024-47613

Indicators of Compromise

• Unexpected crashes or segmentation faults in GStreamer-based media applications
• Core dump files containing references to gst_gdk_pixbuf_dec_flush or gstgdkpixbufdec.c
• Application logs showing null pointer access violations during media processing
• Repeated crashes when processing specific media files

Detection Strategies

• Monitor system logs for SIGSEGV signals originating from GStreamer processes
• Implement crash dump analysis to identify null pointer dereference patterns in GStreamer components
• Deploy file integrity monitoring for media files that consistently cause application crashes
• Use runtime application self-protection (RASP) to detect and prevent null pointer access attempts

Monitoring Recommendations

• Enable application crash reporting and analyze crash patterns for GStreamer-related failures
• Monitor for unusual media file processing failures in automated pipelines
• Track GStreamer process terminations and correlate with media file inputs
• Implement logging for all media file processing operations to identify potentially malicious files

How to Mitigate CVE-2024-47613

Immediate Actions Required

• Update GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability
• Review and update all applications and container images that bundle GStreamer
• Implement input validation for media files before processing with GStreamer
• Consider temporarily disabling or restricting access to the GDK Pixbuf decoder plugin if immediate patching is not possible

Patch Information

The vulnerability has been fixed in GStreamer version 1.24.10. The official patch is available through the GitLab Merge Request Patch. Additional security information is available in the GStreamer Security Advisory and the GitHub Security Advisory.

For Debian-based systems, refer to the Debian LTS Announcement for distribution-specific patches.

Workarounds

• Restrict processing of untrusted media files until the patch is applied
• Implement application sandboxing to limit the impact of crashes on the broader system
• Use input validation to reject malformed media files before they reach GStreamer
• Consider running media processing tasks in isolated environments or containers

# Configuration example
# Check installed GStreamer version
gst-inspect-1.0 --version

# Update GStreamer on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade gstreamer1.0-plugins-good

# Update GStreamer on Fedora/RHEL systems
sudo dnf update gstreamer1-plugins-good

# Verify the installed version is 1.24.10 or later
gst-inspect-1.0 --version | grep -E "GStreamer.*1\.24\.(1[0-9]|[2-9][0-9])"