Gstreamer ID3v2 v1.0 - Out of Bounds Read


A maliciously crafted ID3v2-tagged file enables an out-of-bounds memory read against Gstreamer 1.0.

The Gstreamer ID3v2 implementation uses arbitrarily supplied data to generate buffers for the ID3v2 object and frames. By providing a maliciously crafted file with a null length in the ID3v2 header and an arbitrarily set length in the succeeding frame it is possible to generate an out of bounds read. An attacker may leverage this vulnerability to cause at minimum a denial of service attack.


This vulnerability previously affects GNU/Linux-based Firefox versions 43 and below. Since Firefox is no longer built against Gstreamer the vulnerability is no longer relevant.


Relevant Data Structure:

ID3v2 Header Size (Offset 0x6): 4 bytes ID3v2 Frame Size (Offset 0xE): 4 bytes

Reproduction:


Command
Impact

GST_DEBUG="*:6" totem crash.mp3
crashes

GST_DEBUG="*:6" totem no-crash.mp3
this file overflows but does not cause a crash in non-ASAN builds


More info and sample files: https://github.com/joshuayabut/gstreamerID3v2/tree/master

- MOVRCX X64 EDITION


Sent from [ProtonMail](https://protonmail.ch), encrypted email based in Switzerland.