CVE-2024-47601

What it actually does

Null pointer dereference in gst_matroska_demux_parse_blockgroup_or_simpleblock within matroska-demux.c when GstBuffer *sub is invalid, resulting in application crash during Matroska parsing.

Why it matters to the business

Disrupts media playback and processing pipelines using GStreamer, potentially causing service outages or denial of service in applications that handle Matroska files.

How an attack unfolds

An attacker crafts a malicious Matroska file that triggers invalid buffer conditions in the demuxer, causing the null dereference during block group or simple block parsing.

How to fix it

Upgrade GStreamer to version 1.24.10 or apply the fix in commit 5be4b6f03689ab438822f6cfcd13f1f300afe203.

How to confirm the fix worked

Confirm GStreamer version is 1.24.10 or newer; test with crafted Matroska files to ensure no crashes occur during demuxing.

Typical attack path

1. Craft a malicious Matroska media file exploiting invalid buffer conditions
2. Deliver the file to a target application using GStreamer
3. Trigger parsing via gst_matroska_demux_parse_blockgroup_or_simpleblock
4. Induce null pointer dereference and application crash

How to detect it

Monitor application and system logs for segmentation faults or crashes involving matroska-demux.c; inspect core dumps or stack traces referencing gst_matroska_demux_parse_blockgroup_or_simpleblock.

What your security team should do

• Update GStreamer to 1.24.10 or later in all affected media pipelines
• Audit and replace any custom or pinned older builds of the library
• Implement sandboxing or input sanitization for untrusted media files