CVE-2024-47542

What it actually does

Null pointer dereference in id3v2_read_synch_uint when work->hdr.frame_data is null, dereferencing an unvalidated pointer and triggering a segmentation fault.

Why it matters to the business

Applications that parse media files with GStreamer can be crashed remotely, interrupting media playback, streaming, or processing services and requiring restarts.

How an attack unfolds

An attacker supplies a specially crafted media file containing an ID3v2 tag that causes id3v2_read_synch_uint to receive a null frame_data pointer; when the function attempts to read from the null pointer a segmentation fault occurs and the process terminates.

How to fix it

Upgrade gstreamer to the version containing commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 (corresponding to the 1.24.10 release) or later.

How to confirm the fix worked

Confirm the installed GStreamer version includes commit 5be4b6f03689ab438822f6cfcd13f1f300afe203; test parsing of crafted ID3v2 files and verify no segmentation fault occurs.

Typical attack path

1. Attacker crafts a media file with malformed ID3v2 metadata that sets frame_data to null
2. Victim application opens or processes the file using GStreamer
3. id3v2_read_synch_uint is invoked with the null pointer
4. Dereference of the null pointer triggers SEGV and process crash

How to detect it

Review system and application logs for segmentation faults in GStreamer processes triggered while parsing ID3v2-tagged media; correlate crashes with recent file ingestion events.

• segmentation fault.*id3v2.c
• gstreamer.*SEGV
• id3v2_read_synch_uint

What your security team should do

• Immediately update all GStreamer installations to a build containing commit 5be4b6f03689ab438822f6cfcd13f1f300afe203
• Scan build pipelines and dependency manifests for vulnerable GStreamer versions
• Monitor crash logs for segmentation faults originating from id3v2.c until patches are deployed