CVE-2024-47538

What it actually does

Stack buffer overflow in vorbis_handle_identification_packet allows writing beyond a 64-element position array when channels exceed 64, overwriting the return address (EIP) and GstAudioInfo structure with GST_AUDIO_CHANNEL_POSITION_NONE values.

Why it matters to the business

Applications using GStreamer for media playback or processing can be crashed or have arbitrary code executed when handling crafted Vorbis streams, leading to service disruption or full system compromise in media pipelines.

How an attack unfolds

An attacker supplies a specially crafted Vorbis identification packet containing more than 64 audio channels; during decoding the loop writes outside the stack-allocated position buffer, corrupting the saved return address and enabling control-flow hijacking or structure overwrite.

How to fix it

Upgrade GStreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in the GIT repository; rebuild and redeploy affected applications.

How to confirm the fix worked

Confirm installed GStreamer version is 1.24.10 or later; test with a Vorbis stream containing 65+ channels and verify absence of crashes or unexpected memory writes.

Typical attack path

1. Craft malicious Vorbis stream with vd->vi.channels > 64
2. Deliver stream to target application using GStreamer vorbisdec
3. Trigger identification packet handling to cause out-of-bounds write
4. Overwrite EIP or GstAudioInfo to achieve code execution or crash

How to detect it

Monitor application logs and crash reports for segmentation faults or memory corruption signals during Vorbis decoding; inspect process memory dumps for overwritten position arrays or corrupted GstAudioInfo structures.

What your security team should do

• Immediately update all GStreamer installations to the fixed version
• Scan media-processing pipelines for use of vorbisdec and prioritize patching
• Implement input validation or sandboxing around untrusted media streams until patched