CVE-2022-1924

Vulnerability

An integer overflow vulnerability exists in the LZO decompression function of the matroskademux element in GStreamer. When processing a crafted Matroska file with LZO-compressed data, the integer overflow can lead to a segmentation fault or, depending on the libc implementation and OS memory management, a heap overwrite. The issue affects GStreamer versions prior to the fix. [1]

Exploitation

An attacker can exploit this vulnerability by providing a malicious Matroska file containing specially crafted LZO-compressed data. No authentication or special network position is required; the victim must only open the file with a GStreamer-based application that uses the matroskademux element. The integer overflow occurs during memory reallocation, and the outcome depends on whether the libc uses mmap for large allocations. If mmap is used, the overflow results in a segfault; otherwise, it may cause a heap overwrite. [1]

Impact

Successful exploitation can lead to a denial of service via segmentation fault. In environments where the libc does not use mmap for large chunks, the heap overwrite could potentially be leveraged for arbitrary code execution, though the CVE description only confirms the possibility of a heap overwrite. The impact is limited to the context of the GStreamer process. [1]

Mitigation

The issue was reported in the GStreamer issue tracker and fixed in subsequent releases. Users should update to GStreamer 1.20.3 or later, or apply the patch referenced in the advisory. No workaround is available other than avoiding untrusted Matroska files until the update is applied. [1]