CVE-2024-47835 Overview
CVE-2024-47835 is a null pointer dereference vulnerability in GStreamer, an open-source library for constructing graphs of media-handling components. The flaw resides in the parse_lrc function within gstsubparse.c, which processes LRC subtitle files. The function calls strchr() to locate the ] character in a string and then passes the returned pointer to g_strdup() without validating the result. When the input string lacks the ] character, strchr() returns NULL, and the subsequent g_strdup(start + 1) call triggers a null pointer dereference. The vulnerability is tracked as [CWE-476] and was fixed in GStreamer version 1.24.10.
Critical Impact
A local attacker can crash GStreamer-based applications by supplying a crafted LRC subtitle file, resulting in denial of service when the malformed file is parsed.
Affected Products
- GStreamer versions prior to 1.24.10
- Applications and media players that link against vulnerable GStreamer libraries
- Linux distributions shipping affected GStreamer packages, including Debian LTS
Discovery Timeline
- 2024-12-12 - CVE-2024-47835 published to NVD
- 2026-03-17 - Last updated in NVD database
Technical Details for CVE-2024-47835
Vulnerability Analysis
The vulnerability resides in the LRC subtitle parser within GStreamer's subparse plugin. The parse_lrc function in gstsubparse.c processes synchronized lyrics files that contain timestamped text enclosed in square brackets. During parsing, the function searches for the closing bracket character ] using the standard C library function strchr(). The returned pointer is then directly forwarded to g_strdup() without a preceding null check.
When a crafted LRC file omits the expected ] delimiter, strchr() returns NULL. The subsequent expression g_strdup(start + 1) performs pointer arithmetic on the NULL value and dereferences it, causing the application to crash. The impact is limited to availability since the dereference terminates the process rather than enabling code execution.
Root Cause
The root cause is missing return value validation after calling strchr(). The parser assumes the input conforms to the LRC format and trusts that the closing bracket is always present. This violates safe input handling practices for file format parsers exposed to untrusted content.
Attack Vector
Exploitation requires local user interaction. An attacker must deliver a malicious LRC subtitle file and convince a user to open it with a GStreamer-based media application. The vulnerability cannot be triggered remotely without user involvement, and no privilege escalation or code execution path has been demonstrated.
For technical details, see the GStreamer Security Advisory 2024-0029 and the GitHub Security Advisory GHSL-2024-263.
Detection Methods for CVE-2024-47835
Indicators of Compromise
- Unexpected crashes of media players or applications using GStreamer when opening subtitle files
- Core dumps referencing parse_lrc or gstsubparse.c in stack traces
- Presence of LRC files from untrusted sources lacking properly closed bracket delimiters
Detection Strategies
- Inventory installed GStreamer versions across Linux endpoints and confirm whether they precede 1.24.10
- Inspect crash telemetry and core dump artifacts for signatures matching the parse_lrc call path
- Scan LRC files in shared file repositories for malformed timestamps missing the ] character
Monitoring Recommendations
- Monitor process termination events for media-handling applications and correlate with recently opened subtitle files
- Track package management activity to validate that GStreamer updates are applied across the fleet
- Alert on repeated crashes of the same GStreamer-linked process from a single user session
How to Mitigate CVE-2024-47835
Immediate Actions Required
- Upgrade GStreamer to version 1.24.10 or later on all affected systems
- Apply distribution security updates, including the fixes referenced in the Debian LTS Announcement
- Restrict opening of LRC subtitle files received from untrusted sources until patches are deployed
Patch Information
The upstream fix adds a null check on the pointer returned by strchr() before passing it to g_strdup(). The patch is available as a GitLab Merge Request Patch and is included in GStreamer 1.24.10. Distribution maintainers have backported the fix to supported branches, including Debian LTS.
Workarounds
- Disable or remove the subparse plugin in environments where LRC subtitle support is not required
- Configure media applications to reject subtitle files from untrusted origins
- Run GStreamer-based applications under sandboxing frameworks that contain crashes to a single user session
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
