CVE-2024-47775: GStreamer OOB-Read DoS Vulnerability

CVE-2024-47775 Overview

CVE-2024-47775 is an Out-of-Bounds Read vulnerability discovered in GStreamer, a widely-used open-source multimedia framework for constructing graphs of media-handling components. The vulnerability exists within the parse_ds64 function in gstwavparse.c, where insufficient boundary validation allows attackers to read beyond allocated buffer limits when processing malformed WAV files.

Critical Impact

This vulnerability can lead to denial of service through application crashes or potential information disclosure through memory leakage when processing specially crafted WAV media files.

Affected Products

• GStreamer versions prior to 1.24.10
• Applications and systems using vulnerable GStreamer WAV parsing functionality
• Linux distributions shipping affected GStreamer packages

Discovery Timeline

• 2024-12-12 - CVE CVE-2024-47775 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2024-47775

Vulnerability Analysis

The vulnerability resides in GStreamer's WAV file parsing component, specifically within the parse_ds64 function located in gstwavparse.c. This function is responsible for parsing the DS64 chunk found in RF64 WAV files, which extends the standard WAV format to support files larger than 4GB.

The core issue is that the parse_ds64 function performs multiple GST_READ_UINT32_LE operations on an input buffer without first verifying that the buffer contains sufficient data for these read operations. When a malformed or truncated WAV file is processed, the function may attempt to read data beyond the actual buffer boundaries.

This out-of-bounds read condition can result in two primary security impacts: application crash leading to denial of service, or the potential exposure of sensitive information from adjacent memory regions that gets incorporated into processing results.

Root Cause

The root cause is a missing boundary check in the parse_ds64 function. Before reading unsigned 32-bit little-endian values from the buffer using GST_READ_UINT32_LE macros, the code should validate that buf contains enough bytes to satisfy each read operation. The absence of this validation means that if a DS64 chunk is smaller than expected, the parser will read past the end of the allocated buffer memory.

Attack Vector

Exploitation of CVE-2024-47775 requires local access and typically involves providing a maliciously crafted WAV file to an application using GStreamer for media processing. An attacker could:

1. Create a specially crafted WAV file with a truncated or malformed DS64 chunk
2. Deliver this file to a victim through various means (email attachment, download, media sharing)
3. When the victim opens or processes the file with a GStreamer-based application, the vulnerable parse_ds64 function is triggered
4. The out-of-bounds read occurs, potentially causing a crash or leaking memory contents

The vulnerability exploits the trust placed in media file metadata without proper validation, making it effective against any application that processes user-supplied WAV files through GStreamer.

Detection Methods for CVE-2024-47775

Indicators of Compromise

• Unexpected crashes in GStreamer-based applications when processing WAV files
• Abnormal memory access patterns or segmentation faults in media processing workflows
• Application logs showing errors related to gstwavparse or DS64 chunk parsing

Detection Strategies

• Monitor for crashes or exceptions in applications utilizing GStreamer WAV parsing functionality
• Implement input validation to detect malformed WAV files before processing
• Deploy runtime memory protection mechanisms such as AddressSanitizer (ASan) in development environments to identify OOB read attempts
• Audit media processing pipelines for anomalous behavior when handling RF64/WAV content

Monitoring Recommendations

• Enable core dump collection and analysis for GStreamer-based applications
• Implement logging around media file parsing operations to track file sources
• Monitor system resources for signs of exploitation attempts through repeated crashes

How to Mitigate CVE-2024-47775

Immediate Actions Required

• Update GStreamer to version 1.24.10 or later immediately
• Audit systems for vulnerable GStreamer installations using package managers
• Restrict processing of untrusted WAV files until patches are applied
• Consider implementing sandboxing for media processing workflows

Patch Information

The vulnerability has been fixed in GStreamer version 1.24.10. The official patch is available through the GitLab Merge Request 8042. Additional details can be found in the GStreamer Security Advisory SA-2024-0027 and the GitHub Security Advisory GHSL-2024-261.

Debian users should refer to the Debian LTS Announcement for distribution-specific patching guidance.

Workarounds

• Disable or restrict WAV file parsing in GStreamer pipelines if not required
• Implement file size and structure validation before passing WAV files to GStreamer
• Use application sandboxing to limit the impact of potential exploitation
• Consider using alternative parsers for WAV content until patching is complete

# Check installed GStreamer version
gst-launch-1.0 --version

# Update GStreamer on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade gstreamer1.0-plugins-good

# Update GStreamer on Fedora/RHEL systems
sudo dnf update gstreamer1-plugins-good