CVE-2024-47540: 
NixOS vulnerability analysis and mitigation

GStreamer, a library for constructing graphs of media-handling components, was found to contain an uninitialized stack variable vulnerability in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. The vulnerability, identified as CVE-2024-47540, was discovered and reported by Antonio Morales from the GitHub Security Lab team. The issue affects versions prior to 1.24.10 and was fixed on December 3, 2024 (GitHub Advisory, GStreamer Advisory).

The vulnerability occurs when size < 4, where the program calls gst_buffer_unmap with an uninitialized map variable. Subsequently, in the gst_memory_unmap function, the program attempts to unmap the buffer using this uninitialized map variable, causing a function pointer hijack as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. The severity of the impact is reflected in its CRITICAL CVSS score, indicating the potential for complete compromise of system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability requires processing a specially crafted input file to trigger the usage of uninitialized stack memory. This can result in calls to uninitialized function pointers and crashes, with the potential for code execution through stack manipulation (GStreamer Advisory).

The vulnerability has been fixed in GStreamer version 1.24.10. Users of older versions are advised to update to this version or apply and recompile with the available patch. Red Hat has also released security updates for affected products to address this vulnerability (GStreamer Advisory, Red Hat Advisory).