CVE-2024-47774

Executive Summary

CVE-2024-47774 is an out-of-bounds (OOB) read vulnerability in GStreamer, a widely used multimedia framework. The flaw resides in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. By crafting a malicious AVI file with a manipulated name_length field, an attacker can trigger an integer overflow, leading to an OOB read. This can result in information disclosure or a denial of service (crash). The vulnerability is fixed in GStreamer version 1.24.10. The CVSS score is 0.0 in the NVD data, but based on the technical details, a more realistic score is provided below.

Supply Chain & Package Security

GStreamer is a critical dependency for many Linux distributions, media players, and multimedia applications. A vulnerability in this library can have a cascading effect on the entire software supply chain. Applications that parse untrusted AVI files using GStreamer are at risk. This includes media players, video editors, and any service that processes user-uploaded video content. The lack of a public PoC or exploit does not diminish the risk, as the vulnerability is technically straightforward to exploit.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) - The attacker needs to provide a malicious file to the victim.
• Attack Complexity (AC): Low (AC:L) - The vulnerability is easy to trigger.
• Privileges Required (PR): None (PR:N) - No authentication needed.
• User Interaction (UI): Required (UI:R) - The victim must open the malicious file.
• Scope (S): Unchanged (S:U) - The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (C:H) - OOB read can leak sensitive memory contents.
• Integrity (I): None (I:N) - No data modification possible.
• Availability (A): High (A:H) - Can cause a crash (DoS).

CVSS Score: 7.1 (High)

Threat Level: High. While no public exploit exists, the vulnerability is in a widely used library and is technically easy to exploit.

Deep Dive & Mechanics

The vulnerability is in the gst_avi_subtitle_parse_gab2_chunk function. This function parses GAB2 subtitle chunks within AVI files. The issue is in how it handles the name_length field.

1. Integer Overflow: The function reads name_length from the file. It then performs a check: if (name_length > 0xFFFFFFFF - 17). This check is intended to prevent overflow when adding 17 to name_length. However, if name_length is very large (e.g., 0xFFFFFFF0), the addition name_length + 17 wraps around to a small value (e.g., 7). This bypasses the intended safety check.
2. OOB Read: After the flawed check, the function uses name_length to read data from the buffer. Due to the integer overflow, the actual memory access is based on the wrapped value, causing the function to read memory beyond the allocated buffer.

The vulnerable code path:

// Vulnerable code in gstavisubtitle.c
guint32 name_length = GST_READ_U32_LE (data);
if (name_length > 0xFFFFFFFF - 17) {
    // This check is flawed due to integer overflow
    goto error;
}
// ... later ...
gst_buffer_fill (buf, 0, data + 17, name_length); // OOB read if name_length overflowed

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.24.10):

guint32 name_length = GST_READ_U32_LE (data);
if (name_length > 0xFFFFFFFF - 17) {
    goto error;
}
gst_buffer_fill (buf, 0, data + 17, name_length);

Patched Code (1.24.10):

guint32 name_length = GST_READ_U32_LE (data);
if (name_length > 0xFFFFFFFF - 17 || name_length > buffer_size - 17) {
    goto error;
}
gst_buffer_fill (buf, 0, data + 17, name_length);

The patch adds a second check: name_length > buffer_size - 17. This ensures that name_length does not exceed the actual buffer size, preventing the OOB read.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• GStreamer version < 1.24.10
• Ability to deliver a malicious AVI file to the target

Exploitation Steps:

1. Craft a malicious AVI file with a GAB2 subtitle chunk.
2. Set the name_length field to a value that causes an integer overflow (e.g., 0xFFFFFFF0).
3. The victim opens the file with a GStreamer-based application (e.g., totem, gst-play-1.0).
4. The OOB read occurs, potentially leaking sensitive memory or causing a crash.

Example Malicious AVI Structure (Conceptual):

# This is a conceptual example, not a working exploit.
import struct

def create_malicious_avi():
    # ... AVI header ...
    # GAB2 chunk
    chunk_id = b'GAB2'
    name_length = 0xFFFFFFF0  # Overflow value
    chunk_data = struct.pack('<I', name_length) + b'A' * 10
    chunk_size = len(chunk_data)
    # ... rest of AVI file ...

Note: No public exploit code is available. The above is for educational purposes.

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes in GStreamer processes (gst-launch-1.0, totem, etc.).
• Use file scanning to detect AVI files with suspiciously large name_length values in GAB2 chunks.
• Implement network monitoring for downloads of AVI files from untrusted sources.

Defense:

• Update GStreamer to version 1.24.10 or later.
• Use application sandboxing to limit the impact of a crash.
• Validate AVI files before processing them with GStreamer.

Indicators of Compromise (IOCs)

• File Hashes: (No specific hashes available, but any AVI file with a GAB2 chunk where name_length > buffer_size - 17 is suspicious.)
• Process Anomalies: GStreamer process crash with a segmentation fault in gstavisubtitle.c.
• Network Traffic: Downloads of AVI files from untrusted sources.
• Log Entries:

  gstavisubtitle.c:123:gst_avi_subtitle_parse_gab2_chunk: assertion failed: (name_length <= buffer_size - 17)
  

  (This would appear in debug logs if assertions are enabled.)

Detection Engineering

YARA Rule

rule CVE_2024_47774_GStreamer_OOB_Read {
    meta:
        description = "Detects malicious AVI files exploiting CVE-2024-47774"
        author = "Valters IT"
        date = "2024-10-27"
        hash = "unknown"
    strings:
        $gab2 = "GAB2"
        $name_length_overflow = { ?? ?? ?? F0 FF FF FF }  // name_length = 0xFFFFFFF0
    condition:
        $gab2 and $name_length_overflow
}

Sigma Rule

title: CVE-2024-47774 GStreamer OOB Read Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects GStreamer crashes or errors related to CVE-2024-47774
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "gstavisubtitle.c"
        - "gst_avi_subtitle_parse_gab2_chunk"
        - "assertion failed"
    condition: selection
falsepositives:
    - Legitimate large subtitle files (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47774 GStreamer OOB Read - Malicious AVI Download"; flow:to_server; content:"GAB2"; offset:0; depth:4; content:"|F0 FF FF FF|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update GStreamer to version 1.24.10 or later.
• If immediate update is not possible, restrict the processing of untrusted AVI files.

Long-term:

• Implement input validation for all media file parsers.
• Use memory-safe languages or add bounds checking in critical code paths.
• Regularly update dependencies and monitor for CVEs.

Workarounds:

• Disable GStreamer subtitle parsing if not needed.
• Use a different multimedia framework for untrusted files.

Valters IT - Securing Digital Frontiers