CVE-2024-47613

What it actually does

Null pointer dereference in gst_gdk_pixbuf_dec_flush causes memcpy to write to address 0x00 when out_pix resolves to a NULL frame from the input structure, triggering a segmentation fault.

Why it matters to the business

Media processing pipelines crash on crafted input, leading to service outages for applications that decode or handle image and video streams with GStreamer.

How an attack unfolds

An attacker supplies a media file that causes the gdkpixbuf decoder to read a NULL frame pointer; when flush is called, memcpy attempts a write to the null address and the process terminates.

How to fix it

Upgrade GStreamer to version 1.24.10 or later; apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 on GIT builds.

How to confirm the fix worked

Confirm the installed GStreamer version is 1.24.10 or newer; reprocess known triggering media files and verify absence of segmentation faults in the decoder.

Typical attack path

1. Prepare a specially crafted media file that triggers a NULL frame in the gdkpixbuf decoder path
2. Cause a GStreamer-based application to open and process the file
3. Invoke gst_gdk_pixbuf_dec_flush during decode or seek operations
4. Trigger the memcpy to null address and induce a segmentation fault

How to detect it

Monitor application and system logs for segmentation faults referencing gst_gdk_pixbuf_dec_flush or gstgdkpixbufdec.c; correlate crashes with recent media file ingestion events.

• gst_gdk_pixbuf_dec_flush
• gstgdkpixbufdec.c
• memcpy.*out_pix

What your security team should do

• Prioritize upgrade of all GStreamer installations to 1.24.10 within the next maintenance window
• Scan dependency manifests for gstreamer/gstreamer and enforce the fixed version in build pipelines
• Add crash-monitoring alerts for segmentation faults originating from gstgdkpixbufdec.c