CVE-2021-3185: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2021-3185) was discovered in the gstreamer h264 component of gst-plugins-bad before version 1.18.1. The flaw was identified during a source code audit by Theori and was disclosed on January 20, 2021. The vulnerability affects the H.264 parsing functionality in the gstreamer software, specifically impacting all versions of gstreamer 1.x before 1.18.1 (Openwall).

The vulnerability exists in the gst_h264_slice_parse_dec_ref_pic_marking function when parsing H.264 bitstreams. The flaw occurs due to a missing bounds check on the dec_ref_pic_m->n_ref_pic_marking index variable, where the destination array dec_ref_pic_m->ref_pic_marking has a fixed size of 10 elements. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could lead to stack buffer overflow, memory corruption, and potentially remote code execution. The overflown array is within a GstH264DecRefPicMarking structure allocated on the stack, allowing attackers to modify other fields within GstH264SliceHdr without triggering stack canaries. Successful exploitation could result in complete system compromise (Openwall).

The vulnerable code path can be triggered when gstreamer parses any attacker-controlled H.264 content. Researchers at Theori successfully demonstrated remote code execution in an environment with partial ASLR and without stack canaries, though exploitation would be significantly more difficult on modern desktop Linux distributions (Openwall).

The vulnerability was fixed in gstreamer versions 1.18.1 and 1.16.3 through a patch that implements proper bounds checking on the array index. Users are advised to upgrade to these or later versions. The fix was implemented through a merge request in the GStreamer project repository (Openwall).