CVE-2024-47607

What it actually does

Stack-based buffer overflow in gst_opus_dec_parse_header allows an attacker-supplied n_channels value greater than 64 to overwrite adjacent stack memory including the saved instruction pointer with GST_AUDIO_CHANNEL_POSITION_NONE values.

Why it matters to the business

Media-processing applications built on GStreamer can be crashed or used to execute attacker-controlled code when they decode untrusted Opus audio, potentially leading to service outages or full host compromise in pipelines that handle user-supplied media.

How an attack unfolds

An attacker supplies a crafted Opus stream whose header declares more than 64 channels; the vulnerable parse loop writes beyond the 64-byte pos array on the stack, corrupting the return address and allowing control-flow hijacking when the function returns.

How to fix it

Upgrade GStreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203; rebuild and redeploy all dependent applications against the patched library.

How to confirm the fix worked

Confirm the installed GStreamer package reports version 1.24.10 or later; run unit tests with an Opus header containing n_channels=65 and verify the process no longer crashes or exhibits memory corruption.

Typical attack path

1. Attacker creates or mutates an Opus file or stream with n_channels > 64
2. Target application feeds the stream to a GStreamer pipeline containing the Opus decoder
3. gst_opus_dec_parse_header is invoked during header parsing
4. The loop writes GST_AUDIO_CHANNEL_POSITION_NONE past the end of the stack-allocated pos buffer
5. Saved return address is overwritten, execution is redirected on function return

How to detect it

Monitor application and system logs for segmentation faults or crashes inside libgstreamer or gstopusdec during Opus decoding; inspect core dumps for overwritten stack frames near gst_opus_dec_parse_header; correlate with inbound media uploads containing Opus streams.

What your security team should do

• Immediately update GStreamer to the fixed version in all build and deployment pipelines
• Inventory applications that link against libgstreamer and schedule emergency patches
• Add GStreamer version checks to continuous-integration and container-scanning processes
• Block or sanitize untrusted Opus streams at ingestion points until patches are applied