CVE-2024-47540

What it actually does

Uninitialized stack variable in gst_matroska_demux_add_wvpk_header causes gst_buffer_unmap to be called with an uninitialized map; subsequent gst_memory_unmap then dereferences the invalid map leading to function pointer hijack of mem->allocator->mem_unmap_full or mem_unmap and potential arbitrary code execution.

Why it matters to the business

Systems that ingest or play Matroska media files can be fully compromised, allowing attackers to run malicious code, steal data, or install persistent malware across media-processing applications and pipelines that depend on GStreamer.

How an attack unfolds

An attacker supplies a specially crafted Matroska file that reaches the vulnerable code path with size < 4; the uninitialized map variable is passed to unmap routines, hijacking the allocator function pointer and redirecting execution to attacker-controlled memory.

How to fix it

Upgrade GStreamer to version 1.24.10 or later; apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 on GIT builds; rebuild and redeploy any dependent packages.

How to confirm the fix worked

Confirm installed GStreamer version is 1.24.10 or newer; verify the fix is present in matroska-demux.c by checking that gst_matroska_demux_add_wvpk_header properly initializes the map variable before the unmap call.

Typical attack path

1. Deliver malicious .mkv file to any application or service that uses GStreamer matroska-demux
2. Trigger file parsing so gst_matroska_demux_add_wvpk_header is invoked
3. Force size < 4 condition to use uninitialized map variable
4. Hijack allocator function pointer to execute attacker code

How to detect it

Monitor application logs and crash reports for GStreamer matroska-demux errors or segmentation faults during .mkv processing; inspect process memory dumps for signs of allocator function pointer corruption when handling Matroska streams.

What your security team should do

• Immediately update all GStreamer installations to 1.24.10
• Inventory and replace any embedded or statically linked copies of the library
• Restrict untrusted Matroska file processing until patches are applied
• Add GStreamer version checks to build and deployment pipelines