CVE-2022-1922

Vulnerability

An integer overflow vulnerability exists in GStreamer's Matroska demuxer (matroskademux) within the gst_matroska_decompress_data function during zlib decompression. This occurs when processing a crafted Matroska file with maliciously compressed data, leading to an integer overflow that can cause a segmentation fault or, depending on the libc and OS, a heap overwrite [1]. The affected versions are those prior to the fix, though the exact patched version is not specified in the available references.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted Matroska file to a target application using GStreamer's Matroska demuxer. No authentication or special network position is required; the file can be delivered via any means (e.g., web download, email attachment). When the file is parsed, the integer overflow in the decompression routine triggers a memory corruption that may result in a crash or, under certain libc/OS combinations, a heap overwrite.

Impact

Successful exploitation leads to a denial of service (segfault) in most cases, but if the libc does not use mmap for large allocations and the OS does not support mmap, a heap overwrite may occur, potentially allowing arbitrary code execution within the context of the GStreamer process. The impact is limited to the application using the vulnerable library.

Mitigation

No official fix or patched version has been disclosed in the available references [1]. Users should monitor GStreamer security advisories and update to the latest version once a fix is released. As a workaround, avoid processing untrusted Matroska files until a patch is applied.