Stack-based buffer overflow in gstreamer - CVE-2021-3185

Vulnerability identifier: #VU49938

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3185

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing a h264 header in the gstreamer h264 component. A remote attacker can send specially crafted data to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

gstreamer
gst-plugins-bad1.0 (Debian package)
SUSE Linux Enterprise Module for Packagehub Subpackages
libgstegl-1_0-0
libgstegl-1_0-0-debuginfo
libgstgl-1_0-0
libgstinsertbin-1_0-0-debuginfo
libgstinsertbin-1_0-0
gstreamer-plugins-bad-devel
libgsturidownloader-1_0-0-debuginfo
libgsturidownloader-1_0-0
libgstphotography-1_0-0-debuginfo
libgstphotography-1_0-0
libgstmpegts-1_0-0-debuginfo
libgstmpegts-1_0-0
libgstgl-1_0-0-debuginfo
libgstcodecparsers-1_0-0-debuginfo
libgstcodecparsers-1_0-0
libgstbasecamerabinsrc-1_0-0-debuginfo
libgstbadvideo-1_0-0-debuginfo
gstreamer-plugins-bad-lang
gstreamer-plugins-bad
gstreamer-plugins-bad-debuginfo
gstreamer-plugins-bad-debugsource
libgstadaptivedemux-1_0-0
libgstadaptivedemux-1_0-0-debuginfo
libgstbadaudio-1_0-0
libgstbadaudio-1_0-0-debuginfo
libgstbadbase-1_0-0
libgstbadbase-1_0-0-debuginfo
libgstbadvideo-1_0-0
libgstbasecamerabinsrc-1_0-0
libgstbadallocators-1_0-0
libgstbadallocators-1_0-0-debuginfo
typelib-1_0-GstPlayer-1_0
typelib-1_0-GstMpegts-1_0
typelib-1_0-GstInsertBin-1_0
typelib-1_0-GstGL-1_0
typelib-1_0-GstBadAllocators-1_0
libgstwayland-1_0-0-debuginfo
libgstwayland-1_0-0
libgstplayer-1_0-0-debuginfo
libgstplayer-1_0-0
gstreamer1-plugins-bad-free-debugsource
gstreamer1-plugins-bad-free
gstreamer1-plugins-bad-free-debuginfo
gstreamer1-plugins-bad-free-devel
gstreamer-plugins-ugly-lang
typelib-1_0-Gst-1_0
gstreamer-lang
gstreamer-plugins-good-lang
gstreamer-utils-debuginfo
gstreamer-utils
gstreamer-devel
libgstreamer-1_0-0-32bit-debuginfo
gstreamer-32bit-debuginfo
gstreamer-32bit
libgstreamer-1_0-0-32bit
gstreamer-plugins-ugly-debugsource
gstreamer-plugins-ugly-debuginfo
gstreamer-plugins-ugly
libgstreamer-1_0-0-debuginfo
libgstreamer-1_0-0
gstreamer-debugsource
gstreamer-debuginfo
gstreamer
gstreamer-plugins-good-debuginfo
gstreamer-plugins-good-debugsource
gstreamer-plugins-good
libgstvideo-1_0-0
libgsttag-1_0-0-debuginfo
libgstvideo-1_0-0-debuginfo
libgstrtp-1_0-0-debuginfo
typelib-1_0-GstRtsp-1_0
typelib-1_0-GstSdp-1_0
typelib-1_0-GstTag-1_0
typelib-1_0-GstVideo-1_0
gstreamer-plugins-base-32bit-debuginfo
libgstaudio-1_0-0-32bit
libgstaudio-1_0-0-32bit-debuginfo
typelib-1_0-GstAudio-1_0
libgsttag-1_0-0-32bit
libgsttag-1_0-0-32bit-debuginfo
libgstvideo-1_0-0-32bit
libgstvideo-1_0-0-32bit-debuginfo
gstreamer-plugins-base-devel
libgstaudio-1_0-0-debuginfo
gstreamer-plugins-base
gstreamer-plugins-base-debuginfo
gstreamer-plugins-base-debugsource
libgstallocators-1_0-0
libgstallocators-1_0-0-debuginfo
libgstapp-1_0-0
libgstapp-1_0-0-debuginfo
libgstaudio-1_0-0
typelib-1_0-GstRtp-1_0
libgstpbutils-1_0-0
libgstpbutils-1_0-0-debuginfo
typelib-1_0-GstPbutils-1_0
libgstriff-1_0-0
libgstriff-1_0-0-debuginfo
libgsttag-1_0-0
libgstrtsp-1_0-0
typelib-1_0-GstAllocators-1_0
typelib-1_0-GstApp-1_0
libgstfft-1_0-0
gstreamer-plugins-base-lang
libgstfft-1_0-0-debuginfo
libgstrtp-1_0-0
libgstsdp-1_0-0-debuginfo
libgstsdp-1_0-0
libgstrtsp-1_0-0-debuginfo
libgstsctp-1_0-0-debuginfo
libgstsctp-1_0-0
libgstwebrtc-1_0-0
libgstwebrtc-1_0-0-debuginfo
gstreamer-plugins-bad-chromaprint-debuginfo
gstreamer-plugins-bad-chromaprint
libgstisoff-1_0-0-debuginfo
libgstisoff-1_0-0
typelib-1_0-GstWebRTC-1_0
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Workstation Extension
openEuler

Install updates from vendor's website.

gstreamer - addressed in versions 1.16.3, 1.18.1
gst-plugins-bad1.0 (Debian package) - update to 1.14.4-1deb10u1
libgstegl-1_0-0 - update to 1.2.4-3.7.1
libgstegl-1_0-0-debuginfo - update to 1.2.4-3.7.1
libgstgl-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.3.1
libgstinsertbin-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstinsertbin-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer-plugins-bad-devel - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgsturidownloader-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgsturidownloader-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstphotography-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstphotography-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstmpegts-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstmpegts-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstgl-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.3.1
libgstcodecparsers-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstcodecparsers-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstbasecamerabinsrc-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstbadvideo-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1
gstreamer-plugins-bad-lang - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer-plugins-bad - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer-plugins-bad-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer-plugins-bad-debugsource - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstadaptivedemux-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstadaptivedemux-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstbadaudio-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstbadaudio-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstbadbase-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1
libgstbadbase-1_0-0-debuginfo - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1
libgstbadvideo-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1
libgstbasecamerabinsrc-1_0-0 - addressed in versions 1.8.3-18.3.5, 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstbadallocators-1_0-0 - update to 1.12.5-3.6.1
libgstbadallocators-1_0-0-debuginfo - update to 1.12.5-3.6.1
typelib-1_0-GstPlayer-1_0 - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
typelib-1_0-GstMpegts-1_0 - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
typelib-1_0-GstInsertBin-1_0 - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
typelib-1_0-GstGL-1_0 - addressed in versions 1.12.5-3.6.1, 1.16.3-4.3.1
typelib-1_0-GstBadAllocators-1_0 - update to 1.12.5-3.6.1
libgstwayland-1_0-0-debuginfo - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstwayland-1_0-0 - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstplayer-1_0-0-debuginfo - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
libgstplayer-1_0-0 - addressed in versions 1.12.5-3.6.1, 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer1-plugins-bad-free-debugsource - update to 1.16.2-2
gstreamer1-plugins-bad-free - update to 1.16.2-2
gstreamer1-plugins-bad-free-debuginfo - update to 1.16.2-2
gstreamer1-plugins-bad-free-devel - update to 1.16.2-2
gstreamer-plugins-ugly-lang - update to 1.16.3-3.3.1
typelib-1_0-Gst-1_0 - update to 1.16.3-3.3.1
gstreamer-lang - update to 1.16.3-3.3.1
gstreamer-plugins-good-lang - update to 1.16.3-3.3.1
gstreamer-utils-debuginfo - update to 1.16.3-3.3.1
gstreamer-utils - update to 1.16.3-3.3.1
gstreamer-devel - update to 1.16.3-3.3.1
libgstreamer-1_0-0-32bit-debuginfo - update to 1.16.3-3.3.1
gstreamer-32bit-debuginfo - update to 1.16.3-3.3.1
gstreamer-32bit - update to 1.16.3-3.3.1
libgstreamer-1_0-0-32bit - update to 1.16.3-3.3.1
gstreamer-plugins-ugly-debugsource - update to 1.16.3-3.3.1
gstreamer-plugins-ugly-debuginfo - update to 1.16.3-3.3.1
gstreamer-plugins-ugly - update to 1.16.3-3.3.1
libgstreamer-1_0-0-debuginfo - update to 1.16.3-3.3.1
libgstreamer-1_0-0 - update to 1.16.3-3.3.1
gstreamer-debugsource - update to 1.16.3-3.3.1
gstreamer-debuginfo - update to 1.16.3-3.3.1
gstreamer - update to 1.16.3-3.3.1
gstreamer-plugins-good-debuginfo - update to 1.16.3-3.3.1
gstreamer-plugins-good-debugsource - update to 1.16.3-3.3.1
gstreamer-plugins-good - update to 1.16.3-3.3.1
libgstvideo-1_0-0 - update to 1.16.3-4.3.1
libgsttag-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstvideo-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstrtp-1_0-0-debuginfo - update to 1.16.3-4.3.1
typelib-1_0-GstRtsp-1_0 - update to 1.16.3-4.3.1
typelib-1_0-GstSdp-1_0 - update to 1.16.3-4.3.1
typelib-1_0-GstTag-1_0 - update to 1.16.3-4.3.1
typelib-1_0-GstVideo-1_0 - update to 1.16.3-4.3.1
gstreamer-plugins-base-32bit-debuginfo - update to 1.16.3-4.3.1
libgstaudio-1_0-0-32bit - update to 1.16.3-4.3.1
libgstaudio-1_0-0-32bit-debuginfo - update to 1.16.3-4.3.1
typelib-1_0-GstAudio-1_0 - update to 1.16.3-4.3.1
libgsttag-1_0-0-32bit - update to 1.16.3-4.3.1
libgsttag-1_0-0-32bit-debuginfo - update to 1.16.3-4.3.1
libgstvideo-1_0-0-32bit - update to 1.16.3-4.3.1
libgstvideo-1_0-0-32bit-debuginfo - update to 1.16.3-4.3.1
gstreamer-plugins-base-devel - update to 1.16.3-4.3.1
libgstaudio-1_0-0-debuginfo - update to 1.16.3-4.3.1
gstreamer-plugins-base - update to 1.16.3-4.3.1
gstreamer-plugins-base-debuginfo - update to 1.16.3-4.3.1
gstreamer-plugins-base-debugsource - update to 1.16.3-4.3.1
libgstallocators-1_0-0 - update to 1.16.3-4.3.1
libgstallocators-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstapp-1_0-0 - update to 1.16.3-4.3.1
libgstapp-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstaudio-1_0-0 - update to 1.16.3-4.3.1
typelib-1_0-GstRtp-1_0 - update to 1.16.3-4.3.1
libgstpbutils-1_0-0 - update to 1.16.3-4.3.1
libgstpbutils-1_0-0-debuginfo - update to 1.16.3-4.3.1
typelib-1_0-GstPbutils-1_0 - update to 1.16.3-4.3.1
libgstriff-1_0-0 - update to 1.16.3-4.3.1
libgstriff-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgsttag-1_0-0 - update to 1.16.3-4.3.1
libgstrtsp-1_0-0 - update to 1.16.3-4.3.1
typelib-1_0-GstAllocators-1_0 - update to 1.16.3-4.3.1
typelib-1_0-GstApp-1_0 - update to 1.16.3-4.3.1
libgstfft-1_0-0 - update to 1.16.3-4.3.1
gstreamer-plugins-base-lang - update to 1.16.3-4.3.1
libgstfft-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstrtp-1_0-0 - update to 1.16.3-4.3.1
libgstsdp-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstsdp-1_0-0 - update to 1.16.3-4.3.1
libgstrtsp-1_0-0-debuginfo - update to 1.16.3-4.3.1
libgstsctp-1_0-0-debuginfo - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
libgstsctp-1_0-0 - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
libgstwebrtc-1_0-0 - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
libgstwebrtc-1_0-0-debuginfo - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer-plugins-bad-chromaprint-debuginfo - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
gstreamer-plugins-bad-chromaprint - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
libgstisoff-1_0-0-debuginfo - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
libgstisoff-1_0-0 - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1
typelib-1_0-GstWebRTC-1_0 - addressed in versions 1.16.3-4.4.1, 1.16.3-9.3.1

• https://www.openwall.com/lists/oss-security/2021/01/20/1
• https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/11353b3f6e2f047cc37483d21e6a37ae558896bc
• https://bugzilla.redhat.com/show_bug.cgi?id=1917192

• Remote code execution in GStreamer multimedia framework
• Debian update for gst-plugins-bad1.0
• SUSE update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• openEuler 20.03 LTS update for gstreamer1-plugins-bad-free
• openEuler 20.03 LTS SP1 update for gstreamer1-plugins-bad-free