CVE-2024-47603

Executive Summary

CVE-2024-47603 is a null pointer dereference vulnerability in GStreamer, a widely used multimedia framework. The flaw resides in the gst_matroska_demux_update_tracks function within the Matroska demuxer (matroska-demux.c). When processing a specially crafted Matroska (MKV) file, the function can pass invalid GstCaps (capabilities) objects to gst_caps_is_equal. This leads to a null pointer dereference when GST_BUFFER_MEM_PTR returns a null pointer, and the code attempts to access the size field of that null pointer. The result is a denial of service (DoS) condition, crashing the application using the GStreamer library.

The vulnerability is triggered locally by opening a malicious media file. It does not require authentication but does require user interaction (e.g., opening a file or streaming a malicious URL). The CVSS v3.1 base score is 5.5 (Medium), with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis. The patch is available in GStreamer version 1.24.10.

Supply Chain & Package Security

GStreamer is a critical dependency in many Linux distributions, media players, and multimedia applications. It is commonly distributed via package managers (apt, yum, dnf) and as a library for developers. The vulnerability affects all versions prior to 1.24.10. Organizations should audit their software supply chain for GStreamer versions and update to the patched version. Since GStreamer is often a transitive dependency, a full dependency tree analysis is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to deliver a malicious file to the user.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file or stream.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The vulnerability causes a crash, leading to denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction and only results in a DoS. No public exploit code is available, and the EPSS score is 0.0%.

Deep Dive & Mechanics

The vulnerability is in the gst_matroska_demux_update_tracks function in gst-plugins-good/gst/matroska/matroska-demux.c. This function is responsible for updating track information when parsing a Matroska file. During parsing, it calls gst_caps_is_equal to compare capabilities (caps) of buffers. If the caps are invalid (e.g., null or malformed), the function gst_buffer_get_size is called, which internally uses GST_BUFFER_MEM_PTR to get a pointer to the buffer's memory. If that pointer is null, dereferencing the size field causes a null pointer dereference.

The root cause is a missing validation of the caps before they are used. The fix adds a check to ensure the caps are valid before calling gst_caps_is_equal.

Code Flow:

1. A malicious MKV file is opened.
2. gst_matroska_demux_update_tracks is called.
3. It retrieves caps from a buffer.
4. If the caps are invalid (null or malformed), gst_caps_is_equal is called with invalid arguments.
5. This leads to a call to gst_buffer_get_size.
6. GST_BUFFER_MEM_PTR returns a null pointer.
7. The code attempts to access ptr->size, causing a null pointer dereference and crash.

Vulnerable vs. Patched Code

Vulnerable Code (simplified from matroska-demux.c):

static gboolean
gst_matroska_demux_update_tracks (GstMatroskaDemux * demux, GstBuffer * buf)
{
  GstCaps *caps;
  // ... other code ...
  caps = gst_buffer_get_caps (buf);
  if (gst_caps_is_equal (caps, demux->current_caps)) {
    // ... use caps ...
  }
  // ... other code ...
}

Patched Code (simplified):

static gboolean
gst_matroska_demux_update_tracks (GstMatroskaDemux * demux, GstBuffer * buf)
{
  GstCaps *caps;
  // ... other code ...
  caps = gst_buffer_get_caps (buf);
  if (caps != NULL && gst_caps_is_equal (caps, demux->current_caps)) {
    // ... use caps ...
  }
  // ... other code ...
}

The patch adds a caps != NULL check before calling gst_caps_is_equal, preventing the null pointer dereference.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• GStreamer version < 1.24.10 installed.
• Ability to deliver a malicious MKV file to the target.

Steps:

1. Craft a malicious MKV file that triggers the null pointer dereference. This requires understanding the Matroska format and the specific conditions that cause invalid caps. Since no public exploit exists, this would require reverse engineering.
2. Deliver the file via email, download, or streaming.
3. When the victim opens the file with a GStreamer-based application (e.g., Totem, Rhythmbox, or a custom player), the application crashes.

Example (hypothetical):

# Create a malicious MKV file (requires custom tooling)
python3 craft_malicious_mkv.py -o exploit.mkv

# Deliver to victim
# Victim opens with GStreamer-based player
totem exploit.mkv

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes in GStreamer-based applications.
• Use file integrity monitoring to detect malicious MKV files.
• Deploy endpoint detection and response (EDR) to detect abnormal process crashes.

Defense:

• Update GStreamer to version 1.24.10 or later.
• Implement application whitelisting to prevent untrusted media players.
• Use sandboxing for media processing (e.g., run GStreamer in a container).
• Educate users not to open untrusted media files.

Indicators of Compromise (IOCs)

• File Hashes: No known malicious files at this time.
• Process Names: gst-launch-1.0, totem, rhythmbox, or any application using GStreamer.
• Crash Signatures: Null pointer dereference in gst_matroska_demux_update_tracks or gst_buffer_get_size.
• Network: No network-based IOCs as this is a local file-based vulnerability.

Detection Engineering

YARA Rule

rule CVE_2024_47603_GStreamer_Null_Pointer_Dereference {
    meta:
        description = "Detects malicious MKV files exploiting CVE-2024-47603"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47603"
    strings:
        $matroska_header = "matroska"
        $gst_caps_is_equal = "gst_caps_is_equal"
        $null_check = { 48 85 C0 74 ?? } // test rax, rax; je ...
    condition:
        $matroska_header and $gst_caps_is_equal and not $null_check
}

Sigma Rule

title: CVE-2024-47603 GStreamer Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes in GStreamer due to null pointer dereference in matroska demuxer
author: Valters IT
date: 2024-10-27
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/gst-launch-1.0'
            - '/totem'
            - '/rhythmbox'
        CommandLine|contains: 'matroska'
    condition: selection
falsepositives:
    - Legitimate use of GStreamer with Matroska files
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47603 GStreamer Null Pointer Dereference - Malicious MKV Download"; flow:to_client; file.name:/.*\.mkv/i; content:"matroska"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update GStreamer to version 1.24.10 or later.
• For systems that cannot be updated immediately, apply a workaround by disabling the Matroska demuxer or using a different media library.

Long-term:

• Implement input validation for all media files.
• Use memory-safe languages or add null checks in critical code paths.
• Regularly update dependencies and monitor for CVEs.

Patch Details:

• The fix is included in GStreamer 1.24.10. It adds a null check for caps before calling gst_caps_is_equal.
• Patch commit: (hypothetical) git://anongit.freedesktop.org/gstreamer/gst-plugins-good

Valters IT
DevSecOps & Cyber Threat Intelligence Expert