CVE-2024-47835: 
NixOS vulnerability analysis and mitigation

GStreamer, a library for constructing graphs of media-handling components, was found to contain a null pointer dereference vulnerability (CVE-2024-47835) in the parse_lrc function within gstsubparse.c. The vulnerability was discovered and reported by Antonio Morales from the GHSL team on October 7, 2024, and was fixed in GStreamer version 1.24.10 (GitHub Advisory, GStreamer Advisory).

The vulnerability occurs when the parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and the subsequent call to g_strdup(start + 1) leads to a null pointer dereference. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV) when processing specially crafted input files (GitHub Advisory).

The vulnerability requires a specially crafted file to be processed by the affected GStreamer component. The CVSS metrics indicate that the vulnerability can be exploited over the network with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability has been fixed in GStreamer version 1.24.10. Users are advised to upgrade to this version or apply the available patch. The fix involves adding a NULL check for the return value of strchr() before proceeding with the g_strdup operation (GStreamer Patch).