GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask
CVE-2024-47600

5.1MEDIUM

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
12 December 2024

What is CVE-2024-47600?

GStreamer, a powerful framework for building multimedia applications, contains an out-of-bounds (OOB) read vulnerability within the format_channel_mask function in gst-discoverer.c. This vulnerability arises due to the local position array being limited to 64 elements, while the function gst_discoverer_audio_info_get_channels can potentially return a channels value exceeding this limit. The for loop attempting to access this fixed-size array can lead to reading unintended bytes from the stack, consequently causing memory corruption or undefined behavior. This vulnerability is mitigated in the release version 1.24.10 and underscores the importance of maintaining updated versions to safeguard against potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

gstreamer < 1.24.10

References

https://securitylab.github.com/advisories/GHSL-2024-248_G...
x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merg...
x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-2024-0018.html
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

JSON
.