CVE-2024-47600

What it actually does

Out-of-bounds read in format_channel_mask when gst_discoverer_audio_info_get_channels returns a channels value exceeding the fixed 64-element position array, allowing reads beyond stack bounds and subsequent dereference of value->value_nick that can cause memory corruption or undefined behavior.

Why it matters to the business

Applications using GStreamer for media discovery may crash or leak stack memory when processing audio streams with more than 64 channels, potentially disrupting media pipelines and exposing sensitive data in affected environments.

How an attack unfolds

An attacker supplies a media file or stream containing audio information that reports more than 64 channels; when gst-discoverer processes it, format_channel_mask iterates past the array bounds, reading unintended stack data and potentially triggering further corruption via the nick dereference.

How to fix it

Upgrade gstreamer/gstreamer to the fixed commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 or later release containing the patch; rebuild and redeploy any dependent applications.

How to confirm the fix worked

Confirm the installed GStreamer source or binary includes commit 5be4b6f03689ab438822f6cfcd13f1f300afe203; test with audio streams reporting >64 channels and verify no OOB access or crashes occur.

Typical attack path

1. Craft or obtain media content with audio channel count greater than 64
2. Trigger gst-discoverer or dependent tool on the malicious media
3. format_channel_mask performs OOB array access during channel mask formatting
4. Read unintended stack bytes and dereference value->value_nick causing corruption or crash

How to detect it

Review logs from media discovery or GStreamer processes for segmentation faults or abnormal memory access patterns around gst-discoverer; inspect core dumps for stack reads near format_channel_mask.

What your security team should do

• Apply the upstream fix commit immediately in all build pipelines
• Scan for and replace any statically linked or vendored GStreamer versions older than the patched commit
• Monitor media-processing services for unexpected crashes or memory errors until patched