Heap Corruption Vulnerability in mpg123 Could Lead to Arbitrary Code Execution
CVE-2024-10573

6.7MEDIUM

Key Information:

Status
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 7
Vendor
CVE Published:
31 October 2024

What is CVE-2024-10573?

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

References

https://access.redhat.com/errata/RHSA-2024:11193
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:11242
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-10573
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-10573 : Heap Corruption Vulnerability in mpg123 Could Lead to Arbitrary Code Execution