CVE-2024-47778

What it actually does

Out-of-bounds read in gst_wavparse_adtl_chunk due to missing bounds check on size field in ADTL chunk, allowing read of up to 4 GB of process memory or a segmentation fault.

Why it matters to the business

Media-processing applications using GStreamer may crash or leak memory contents when handling specially crafted WAV files, potentially disrupting playback, encoding, or streaming services and exposing sensitive data from process memory.

How an attack unfolds

An attacker crafts a WAV file containing an ADTL chunk whose size field exceeds the actual buffer length, then supplies the file to any application that uses GStreamer's wavparse element; during parsing the while loop performs an unchecked read that walks past the end of the allocated buffer.

How to fix it

Upgrade GStreamer to version 1.24.10 or later, or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in the gstreamer repository.

How to confirm the fix worked

Confirm the installed GStreamer version is 1.24.10 or newer; re-test parsing of known-malicious WAV samples and verify absence of out-of-bounds reads via memory sanitizer or crash logs.

Typical attack path

1. Attacker creates malicious WAV file with oversized ADTL chunk size
2. Victim application opens or processes the file using GStreamer
3. gst_wavparse_adtl_chunk reads beyond buffer bounds
4. Process memory is disclosed or a crash occurs

How to detect it

Review application and system logs for segmentation faults or abnormal memory usage in processes that invoke libgstreamer and the wavparse plugin; correlate crashes with recent receipt of WAV files from untrusted sources.

What your security team should do

• Update GStreamer to 1.24.10 or the referenced commit across all affected systems
• Scan media ingestion pipelines for use of the wavparse element
• Add file-type validation or sandboxing around untrusted media inputs
• Monitor for segmentation faults in GStreamer-based processes