CVE-2024-24267: 
NixOS vulnerability analysis and mitigation

A memory leak vulnerability was discovered in gpac version 2.2.1, specifically in the gf_fileio_from_blob function where the gfio_blob variable is not properly released (MITRE CVE, NVD). The vulnerability was identified and reported in February 2024.

The vulnerability occurs in the gf_fileio_from_blob function where a pointer variable named gfio_blob is allocated memory through the GF_SAFEALLOC function. If the program returns a null pointer instead of returning a res variable containing the gfio_blob pointer information, the allocated memory area is not released, resulting in a memory leak. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The memory leak vulnerability affects the availability of the system by failing to release allocated memory resources. This can lead to gradual system resource depletion over time, potentially impacting system performance and stability (NVD).

A fix has been implemented through a commit that addresses the memory leak issue by properly freeing the allocated memory when the gf_fileio_new function fails (GPAC Commit).