PT-2024-9586 · Gstreamer+9 · Gstreamer+9
Antonio Morales
+1
·
Published
2024-09-30
·
Updated
2025-10-07
·
CVE-2024-47600
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
GStreamer versions prior to 1.24.10
Description
A vulnerability has been detected in the format channel mask function in gst-discoverer.c, which can cause an out-of-bounds (OOB) read. This occurs when the gst discoverer audio info get channels function returns a value greater than 64, leading to access beyond the bounds of the local position array. As a result, unintended bytes from the stack can be read, potentially causing further memory corruption or undefined behavior due to the dereference of
value->value nick after the OOB-read.Recommendations
For versions prior to 1.24.10, update to version 1.24.10 to resolve the issue. As a temporary workaround, consider restricting access to the
format channel mask function in gst-discoverer.c until a patch is available. Avoid using the gst discoverer audio info get channels function with values greater than 64 until the issue is resolved.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Gstreamer
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu