CVE-2024-47540

Name	CVE-2024-47540
Description	GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4071-1, DSA-5838-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gst-plugins-good1.0 (PTS)	bullseye	1.18.4-2+deb11u2	vulnerable
	bullseye (security)	1.18.4-2+deb11u3	fixed
	bookworm	1.22.0-5+deb12u3	fixed
	bookworm (security)	1.22.0-5+deb12u2	fixed
	trixie	1.26.2-1	fixed
	forky	1.26.6-1	fixed
	sid	1.26.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
gst-plugins-good0.10	source	(unstable)	(unfixed)
gst-plugins-good1.0	source	bullseye	1.18.4-2+deb11u3	DLA-4071-1
gst-plugins-good1.0	source	bookworm	1.22.0-5+deb12u2	DSA-5838-1
gst-plugins-good1.0	source	(unstable)	1.24.10-1

Notes

https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/
https://gstreamer.freedesktop.org/security/sa-2024-0017.html
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3863
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c0dceda8e969f74f2326539c1f0368c2fd7afcd7
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/a16851ebf34a9f9be4285b2c0d75fe7844354efe (1.24.10)