GStreamer: Integer Overflow Vulnerability Affects Memory Allocation

CVE-2024-47537

What is CVE-2024-47537?

The GStreamer library, widely used for managing media components, contains a vulnerability that arises from improper handling of memory allocation during the processing of media streams. An integer overflow occurs when the program attempts to allocate memory for samples based on user-supplied data from an input file. If the samples_count value read from the file is excessively large, it can cause allocation to be significantly smaller than required. This miscalculation leads to an out-of-bounds write when the program further processes these samples, resulting in potential memory corruption or unauthorized access to adjacent memory. This issue has been addressed in GStreamer version 1.24.10, and users are recommended to upgrade to mitigate the risk.

References