GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask

CVE-2024-47600

What is CVE-2024-47600?

GStreamer, a powerful framework for building multimedia applications, contains an out-of-bounds (OOB) read vulnerability within the format_channel_mask function in gst-discoverer.c. This vulnerability arises due to the local position array being limited to 64 elements, while the function gst_discoverer_audio_info_get_channels can potentially return a channels value exceeding this limit. The for loop attempting to access this fixed-size array can lead to reading unintended bytes from the stack, consequently causing memory corruption or undefined behavior. This vulnerability is mitigated in the release version 1.24.10 and underscores the importance of maintaining updated versions to safeguard against potential exploits.

References