GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush
CVE-2024-47613

9.8CRITICAL

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
12 December 2024

What is CVE-2024-47613?

A vulnerability in the GStreamer media library has been identified, specifically in the gst_gdk_pixbuf_dec_flush function located within gstgdkpixbufdec.c. This vulnerability arises from a null pointer dereference issue caused by the function's reliance on out_pix pointing to a valid frame structure read from the input file. Under certain conditions, out_pix may reference a NULL frame, leading to a critical situation when memcpy attempts to write to this null address (0x00). The outcome of this flaw can cause a Denial of Service (DoS), resulting in a segmentation fault, which could lead to service disruptions for applications relying on the GStreamer library. Users of affected versions are encouraged to update to version 1.24.10 or later, where this vulnerability has been addressed.

Affected Version(s)

gstreamer < 1.24.10

References

https://securitylab.github.com/advisories/GHSL-2024-115_G...
x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merg...
x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-2024-0025.html
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.