gstreamer MKV Demuxing gst_matroska_decompress_data heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in gstreamer. This issue affects the function gst_matroska_decompress_data of the component MKV Demuxing. The manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2022-1922. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in gstreamer (Multimedia Processing Software) (the affected version is unknown) and classified as critical. This issue affects the function gst_matroska_decompress_data of the component MKV Demuxing. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.

The weakness was presented 07/20/2022 as 1225. The advisory is shared at gitlab.freedesktop.org. The identification of this vulnerability is CVE-2022-1922 since 05/27/2022. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/17/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Multimedia Processing Software

Name

• gstreamer

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion