Bug 2131007 (CVE-2022-1925)

Summary: CVE-2022-1925 gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using HEADERSTRIP decompression
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bdpepple, elima, fabiano, marcandre.lureau, negativo17, rh-spice-bugs, uraeus, victortoso, wtaymans
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: gstreamer-plugins-good 1.20.3 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in GStreamer. An integer overflow can lead to a heap-based buffer overflow in the mkv demuxer when processing a specially crafted Matroska/WebM file using HEADERSTRIP decompression. This vulnerability can result in application crash, memory corruption, and code execution.
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-09 16:54:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2131008, 2131009, 2131057, 2131058, 2131059, 2131060, 2131061    
Bug Blocks: 2111231    

Description Guilherme de Almeida Suckevicz 2022-09-29 16:38:01 UTC
DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.


Comment 1 Guilherme de Almeida Suckevicz 2022-09-29 16:38:23 UTC
Created gstreamer1-plugins-good tracking bugs for this issue:

Affects: fedora-all [bug 2131009]

Created mingw-gstreamer1-plugins-good tracking bugs for this issue:

Affects: fedora-all [bug 2131008]

Comment 3 errata-xmlrpc 2023-05-09 07:23:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2260 https://access.redhat.com/errata/RHSA-2023:2260

Comment 4 Product Security DevOps Team 2023-05-09 16:54:08 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):