CVE-2022-1925

Vulnerability

An integer overflow vulnerability exists in GStreamer's matroskaparse element within the gst_matroska_decompress_data function during mkv demuxing using HEADERSTRIP decompression. This overflow can lead to a heap overwrite. Affected versions include those before the fix for issue #1225. Note that the matroskademux element has restrictions on chunk sizes that prevent triggering the overflow, but matroskaparse lacks these size checks [1].

Exploitation

An attacker would need to provide a specially crafted Matroska (mkv) file with a malicious HEADERSTRIP compressed chunk that triggers the integer overflow in gst_matroska_decompress_data. Since the issue is in the parser element, the attacker does not need authentication or special network position beyond delivering the file to a user or application that processes it via GStreamer's pipeline using matroskaparse [1].

Impact

Successful exploitation results in a heap buffer overflow, potentially leading to a denial of service (crash) or, in worst-case scenarios, arbitrary code execution depending on heap layout and memory protections. The vulnerability is classified as a DOS / potential heap overwrite [1].

Mitigation

The issue was addressed in GStreamer project's repository (issue #1225). Users should update to a patched version of GStreamer that includes the fix. As a workaround, avoid using the matroskaparse element with untrusted mkv files until the patch is applied. No CVE mentions listing on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].