Denial of Service Vulnerability in GStreamer Matroska Demuxer

CVE-2022-1922

What is CVE-2022-1922?

A vulnerability exists within the GStreamer Matroska demuxer, specifically in the gst_matroska_decompress_data function. This issue is triggered by an integer overflow during the decompression of MKV files using zlib. It can lead to a segmentation fault or, under certain conditions regarding the libc and operating system, may result in a serious memory corruption through a heap overwrite. The vulnerability's impact varies depending on whether the libc implementation utilizes mmap for large memory chunks and whether the underlying operating system supports this feature, which ultimately influences the vulnerability's severity.

References