CVE-2024-47600
Fixed in a distro release EPSS 1%CVSS 5.1
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.
Products: GStreamer
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | gstreamer1-plugins-base | 1.22.12-4.el9 |
| AlmaLinux 9 | gstreamer1-plugins-base-devel | 1.22.12-4.el9 |
| AlmaLinux 9 | gstreamer1-plugins-base-tools | 1.22.12-4.el9 |
| Alpine 3.20 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.21 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.22 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.23 | gst-plugins-base | 1.24.10-r0 |
| Alpine 3.24 | gst-plugins-base | 1.24.10-r0 |
| Debian 11 | gst-plugins-base1.0 | 1.18.4-2+deb11u3 |
| Debian 12 | gst-plugins-base1.0 | 1.22.0-3+deb12u3 |
| Debian 13 | gst-plugins-base1.0 | 1.24.10-1 |
| Debian 14 | gst-plugins-base1.0 | 1.24.10-1 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-debuginfo | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-debugsource | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-devel | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-tools | 0:1.22.12-4.el9 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-base-tools-debuginfo | 0:1.22.12-4.el9 |
| Rocky Linux 9 | gstreamer1-plugins-base | 0:1.22.12-4.el9 |
| SUSE Enterprise Storage 7.1 | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise Micro 5.2 | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise Micro 5.3 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Micro 5.4 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Micro 5.5 | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | gstreamer-plugins-base | 1.24.0-150600.3.8.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | gstreamer-plugins-base | 1.24.0-150600.3.8.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | gstreamer-plugins-base | 1.16.3-150200.4.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | gstreamer-plugins-base | 1.22.0-150500.3.11.1 |
| SUSE Linux Micro 6.0 | gstreamer-plugins-base | 1.22.9-2.1 |
| SUSE Linux Micro 6.1 | gstreamer-plugins-base | 1.24.7-slfo.1.1_2.1 |
| SUSE Manager Proxy 4.3 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| SUSE Manager Server 4.3 | gstreamer-plugins-base | 1.20.1-150400.3.11.1 |
| Ubuntu 16.04 LTS | gst-plugins-base0.10 | no fix |
| Ubuntu 20.04 LTS | gst-plugins-base1.0 | 1.16.3-0ubuntu1.4 |
| Ubuntu 22.04 LTS | gst-plugins-base1.0 | 1.20.1-1ubuntu0.4 |
| Ubuntu 24.04 LTS | gst-plugins-base1.0 | 1.24.2-1ubuntu0.2 |
| Ubuntu Pro 16.04 LTS | gst-plugins-base1.0 | 1.8.3-1ubuntu0.3+esm2 |
| Ubuntu Pro 18.04 LTS | gst-plugins-base1.0 | 1.14.5-0ubuntu1~18.04.3+esm1 |
| openSUSE Leap 15.6 | gstreamer-plugins-base | 1.24.0-150600.3.8.1 |
| openSUSE Tumbleweed | gstreamer-plugins-base | 1.24.10-2.1 |