CVE-2024-47615: 
NixOS vulnerability analysis and mitigation

GStreamer, a library for constructing graphs of media-handling components, was found to contain a vulnerability identified as CVE-2024-47615. The vulnerability was discovered in versions prior to 1.24.10 and was disclosed on December 3, 2024. The issue affects the Ogg demuxer component of the GStreamer library, specifically in the gst_parse_vorbis_setup_packet function within vorbis_parse.c (GitHub Advisory, GStreamer Advisory).

The vulnerability is an out-of-bounds write issue in the gst_parse_vorbis_setup_packet function. The integer size is read from the input file without proper validation, allowing it to exceed the fixed size of the pad->vorbis_mode_sizes array (which has a size of 256). When this occurs, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory. The vulnerability can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array (GitHub Advisory).

The vulnerability can result in application crashes and potentially allow code execution through heap manipulation. The out-of-bounds write can trigger other memory issues, such as invalid frees, and disrupt the program's execution flow (GStreamer Advisory, GitHub Advisory).

The vulnerability can be triggered by processing specially crafted input files that exploit the lack of size validation in the Ogg demuxer component. A malicious third party can create files that trigger the out-of-bounds writes (GStreamer Advisory).

The vulnerability has been fixed in GStreamer version 1.24.10. Users of older versions should update to this version or apply and recompile with the available patch. The fix includes proper validation of the size parameter and checks for writes to GstOggStream.vorbis_mode_sizes (GStreamer Advisory, Patch).