CVE-2024-47601

Executive Summary

CVE-2024-47601 is a NULL pointer dereference vulnerability in GStreamer, a widely used multimedia framework. The flaw resides in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within the Matroska demuxer (matroska-demux.c). When processing a specially crafted Matroska (MKV) file, the function fails to validate the GstBuffer *sub pointer before dereferencing it, leading to a NULL pointer dereference. This results in a denial of service (DoS) condition, typically causing the application to crash. The vulnerability is triggered locally by a user opening a malicious media file, and it does not require authentication. The CVSS score is 0.0 in the NVD data, but based on the description and CWE, a more accurate vector is provided above. The issue is fixed in GStreamer version 1.24.10.

Supply Chain & Package Security

GStreamer is a critical component in many Linux distributions and multimedia applications. It is often distributed as a system library or bundled with applications. The vulnerability affects any software that uses the vulnerable version of GStreamer to parse Matroska files. This includes media players, video editors, streaming services, and any application that relies on GStreamer for multimedia processing. The supply chain risk is moderate, as the vulnerability requires user interaction (opening a malicious file) and only leads to a denial of service, not remote code execution.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - The victim must open the malicious file.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): High (H) - The application crashes, causing a denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction and only results in a DoS. It is not wormable and does not lead to data theft.

Deep Dive & Mechanics

The vulnerability is in the gst_matroska_demux_parse_blockgroup_or_simpleblock function in gst/matroska/matroska-demux.c. This function is responsible for parsing BlockGroup and SimpleBlock elements within a Matroska file. The issue occurs when the function attempts to access a GstBuffer *sub pointer without first checking if it is NULL. In certain malformed MKV files, the sub pointer may not be properly initialized, leading to a NULL pointer dereference when the code tries to read from it.

The vulnerable code path is triggered when the demuxer encounters a BlockGroup or SimpleBlock element with specific characteristics. The function does not validate the sub pointer before using it, which can cause a segmentation fault. The fix in version 1.24.10 adds a NULL check before dereferencing the pointer.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In gst_matroska_demux_parse_blockgroup_or_simpleblock
GstBuffer *sub = ...; // May be NULL if not properly set
// ...
gst_buffer_map(sub, &map, GST_MAP_READ); // NULL pointer dereference

Patched Code (simplified):

// In gst_matroska_demux_parse_blockgroup_or_simpleblock
GstBuffer *sub = ...; // May be NULL if not properly set
// ...
if (sub == NULL) {
    // Handle error or skip
    return GST_FLOW_ERROR;
}
gst_buffer_map(sub, &map, GST_MAP_READ); // Safe now

The patch adds a NULL check for the sub pointer before any dereference. This prevents the crash when processing malformed files.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable GStreamer version (< 1.24.10) installed.
• A tool to craft malformed MKV files (e.g., mkvpropedit, hexedit, or custom Python script).

Exploitation Steps:

1. Create a valid MKV file with a single video/audio track.
2. Use a hex editor to modify the BlockGroup or SimpleBlock element to cause the sub pointer to be NULL. This typically involves corrupting the block data or setting incorrect sizes.
3. Deliver the malicious MKV file to the victim (e.g., via email, download, or USB).
4. When the victim opens the file with a GStreamer-based application (e.g., Totem, VLC, or a custom player), the application will crash.

Example Python script to craft a malformed MKV (conceptual):

import struct

def craft_malicious_mkv():
    # This is a simplified example; real exploitation requires deep knowledge of MKV format
    # The goal is to create a BlockGroup where the sub pointer is not set
    # For demonstration, we corrupt the block data
    with open("malicious.mkv", "wb") as f:
        # Write EBML header
        f.write(b'\x1a\x45\xdf\xa3')  # EBML
        # ... (other headers)
        # Write a corrupted BlockGroup
        f.write(b'\xa0')  # BlockGroup ID
        # ... (corrupted data)
    print("Malicious MKV created")

Note: No public exploit code is available for this CVE. The above is a conceptual guide.

Blue Team

Detection:

• Monitor for crashes in GStreamer-based applications (e.g., totem, gst-launch-1.0).
• Use file integrity monitoring to detect the presence of malformed MKV files.
• Implement application whitelisting to prevent untrusted media players from running.

Prevention:

• Update GStreamer to version 1.24.10 or later.
• Use sandboxing for media processing (e.g., run GStreamer in a container or with reduced privileges).
• Educate users not to open media files from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available, but any MKV file that causes a crash in GStreamer is suspicious.
• Process Behavior: GStreamer process (e.g., gst-launch-1.0, totem) crashes with a segmentation fault.
• Logs: System logs may show entries like:

  gst_matroska_demux_parse_blockgroup_or_simpleblock: assertion 'sub != NULL' failed
  

  Or a segfault in the GStreamer library.
• Network: No network indicators, as this is a local file-based vulnerability.

Detection Engineering

YARA Rule

rule CVE_2024_47601_GStreamer_NULL_Pointer_Dereference {
    meta:
        description = "Detects malformed MKV files that may trigger CVE-2024-47601"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47601"
    strings:
        $ebml = { 1A 45 DF A3 }  // EBML header
        $blockgroup = { A0 }      // BlockGroup ID
        $simpleblock = { A3 }     // SimpleBlock ID
        $corrupt = { 00 00 00 00 00 00 00 00 }  // Example corrupt pattern
    condition:
        $ebml at 0 and ($blockgroup or $simpleblock) and #corrupt > 0
}

Sigma Rule

title: GStreamer CVE-2024-47601 NULL Pointer Dereference
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes in GStreamer due to CVE-2024-47601
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: gstreamer
detection:
    selection:
        EventID: 1000  # Application crash
        Application: "gst-launch-1.0.exe" or "totem.exe" or "vlc.exe"
        FaultModule: "libgstmatroska.so" or "gstmatroska.dll"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47601 GStreamer Malformed MKV Download"; flow:to_client; file_data; content:"|1a 45 df a3|"; within:4; content:"|a0|"; within:2; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update GStreamer to version 1.24.10 or later. This is the only complete fix.
• If updating is not possible, consider disabling Matroska demuxing or using an alternative media framework.

Long-term:

• Implement input validation for all media file parsers.
• Use fuzzing tools (e.g., AFL, libFuzzer) to test media parsing code.
• Apply the principle of least privilege to media processing applications.

Workarounds:

• Use a different media player that does not rely on GStreamer for MKV parsing.
• Scan all incoming MKV files with a file integrity checker.

Valters IT
DevSecOps & Cyber Threat Intelligence