CVE-2022-2122: Integer Overflow in GStreamer qtdemux
CVE ID: CVE-2022-2122
Date: July 19, 2022
Severity: High (CVSS 3.1: 7.8)
CWE: CWE-122 (Heap-based Buffer Overflow), CWE-190 (Integer Overflow), CWE-787 (Out-of-bounds Write)
Affected: GStreamer qtdemux before 1.20.3
Also affects: Debian Linux 10 and 11
🔍 Overview
An integer overflow in the qtdemux_inflate function of the GStreamer qtdemux element can cause a segmentation fault or, depending on the libc and operating system, a heap overwrite. The issue occurs during zlib decompression of QuickTime/MP4 media streams.
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector: Local, low complexity, no privileges required, user interaction required, unchanged scope.
🎯 Impact
An attacker who can cause a victim to process a specially crafted media file may trigger:
- Application crash (denial of service via segfault)
- Heap memory corruption that could potentially lead to arbitrary code execution
- High impact on confidentiality, integrity, and availability if exploited successfully
🛡️ Mitigation
Upgrade GStreamer to 1.20.3 or later. On Debian systems, apply the security updates from DSA-5204. Avoid processing untrusted media files with vulnerable versions of qtdemux.