Log in Start free

Vulnerability · Published Dec 11, 2024 · Assigned by GitHub_M

CVE-2024-47542GHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference

Medium 6.8

In plain English

A medium-severity null pointer dereference in gstreamer from gstreamer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation, resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gstreamer1-plugins-base1.22.12-4.el9ALSA-2025:7243
AlmaLinux:9gstreamer1-plugins-base-devel1.22.12-4.el9ALSA-2025:7243
AlmaLinux:9gstreamer1-plugins-base-tools1.22.12-4.el9ALSA-2025:7243
Alpine:v3.20gst-plugins-base1.24.10-r0ALPINE-CVE-2024-47542
Alpine:v3.21gst-plugins-base1.24.10-r0ALPINE-CVE-2024-47542
Alpine:v3.22gst-plugins-base1.24.10-r0ALPINE-CVE-2024-47542
Alpine:v3.23gst-plugins-base1.24.10-r0ALPINE-CVE-2024-47542
Alpine:v3.24gst-plugins-base1.24.10-r0ALPINE-CVE-2024-47542
Debian:12gst-plugins-base1.01.22.0-3+deb12u4DEBIAN-CVE-2024-47542
Debian:13gst-plugins-base1.01.24.10-1DEBIAN-CVE-2024-47542
Debian:14gst-plugins-base1.01.24.10-1DEBIAN-CVE-2024-47542
Rocky Linux:9gstreamer1-plugins-base0:1.22.12-4.el9RLSA-2025:7243
Ubuntu:22.04:LTSgst-plugins-base1.01.20.1-1ubuntu0.4USN-7175-1
Ubuntu:22.04:LTSgst-plugins-base1.01.20.1-1ubuntu0.4UBUNTU-CVE-2024-47542
Ubuntu:24.04:LTSgst-plugins-base1.01.24.2-1ubuntu0.2UBUNTU-CVE-2024-47542
Ubuntu:24.04:LTSgst-plugins-base1.01.24.2-1ubuntu0.2USN-7175-1

Affected products (as reported)

VendorProductVersions
gstreamer gstreamer < 1.24.10

Weakness: CWE-476, CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References