CVE-2024-47603

What it actually does

Null pointer dereference in gst_matroska_demux_update_tracks when gst_caps_is_equal receives invalid caps, causing GST_BUFFER_MEM_PTR to return null followed by dereference of its size field.

Why it matters to the business

Media-handling applications using GStreamer can crash when processing certain Matroska files, resulting in denial of service and potential disruption to playback or streaming workflows.

How an attack unfolds

An attacker supplies a specially crafted Matroska file containing invalid caps values that reach gst_matroska_demux_update_tracks; when the file is opened the invalid caps trigger the null buffer path and subsequent dereference crash.

How to fix it

Upgrade to GStreamer 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in the gstreamer repository.

How to confirm the fix worked

Confirm installed GStreamer version is 1.24.10 or later and verify the presence of the referenced commit in the source tree; test processing of Matroska files that previously triggered the crash.

Typical attack path

1. Craft Matroska file with invalid caps
2. Deliver file to target system
3. Open file in GStreamer-based application
4. Trigger gst_matroska_demux_update_tracks path leading to null dereference and crash

How to detect it

Review application and system logs for segmentation faults or crashes originating from the matroska-demux module when handling Matroska files.

What your security team should do

• Upgrade all GStreamer installations to 1.24.10 or the fixed commit
• Identify and inventory applications that embed or link against GStreamer
• Restrict untrusted Matroska file processing until patches are applied