GStreamer up to 1.24.9 qtdemux.c qtdemux_parse_theora_extension integer overflow

Summaryinfo

A vulnerability classified as critical has been found in GStreamer up to 1.24.9. Affected by this issue is the function qtdemux_parse_theora_extension of the file qtdemux.c. Performing a manipulation results in integer overflow. This vulnerability is reported as CVE-2024-47606. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in GStreamer up to 1.24.9. This affects the function qtdemux_parse_theora_extension of the file qtdemux.c. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

The advisory is shared at securitylab.github.com. This vulnerability is uniquely identified as CVE-2024-47606 since 09/27/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 213029 (Debian dla-3994 : gir1.2-gstreamer-1.0 - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.24.10 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (213029) and CERT Bund (WID-SEC-2025-0815). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• IBM Java SDK
• IBM Java
• IBM Maximo Asset Management
• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM InfoSphere Information Server
• Open Source OpenJDK
• Red Hat Enterprise Linux
• IBM Tivoli Netcool/OMNIbus
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• Oracle Linux
• IBM SPSS
• NetApp ActiveIQ Unified Manager
• HCL Commerce
• IBM Business Automation Workflow
• Hitachi Configuration Manager
• IBM Security Guardium
• IBM MQ
• IBM QRadar SIEM
• IBM Power Hardware Management Console
• IBM Rational Business Developer
• SUSE openSUSE
• IBM InfoSphere Identity Insight
• Azul Zulu
• IBM Storage Insights
• Hitachi Command Suite
• Hitachi Ops Center
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• IBM Semeru Runtime
• IBM Integration Bus
• Dell NetWorker
• IBM DataPower Gateway
• IBM Installation Manager
• IBM App Connect Enterprise
• IBM License Metric Tool
• IBM Security Verify Access
• IBM TXSeries
• HCL BigFix
• IBM Sterling Connect:Direct
• IBM Tivoli Business Service Manager
• IBM Tivoli Network Manager
• IBM Cognos Analytics

Productinfo

Type

• Multimedia Processing Software

Name

• GStreamer

Version

• 1.24.0
• 1.24.1
• 1.24.2
• 1.24.3
• 1.24.4
• 1.24.5
• 1.24.6
• 1.24.7
• 1.24.8
• 1.24.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion