Ubuntu
gstreamer1.0 package

[DoS] GStreamer hangs when given this malformed file

Bug #1404557 reported by Sergey "Shnatsel" Davidoff <unprivileged account>
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
gstreamer1.0 (Ubuntu)
New
Undecided
Unassigned

Bug Description

Anything based on GStreamer hangs when given the attached video file for playback. Tested on gst-play-1.0, shotwell-video-thumbnailer, Audience and Totem.

Depending on the application this can be accompanied by huge memory usage or significant CPU usage. According to debug output from gst-play-1.0, GStreamer goes into an infinite loop. This can cause denial of service in applications that do not enforce resource limits and operation timeouts - which, admittedly, can be hard to do for video.

The bug was found by American Fuzzy Lop after fuzzing shotwell-video-thumbnailer for 5 minutes.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: libgstreamer1.0-0 1.2.4-0ubuntu1
ProcVersionSignature: Ubuntu 3.13.0-43.72-generic 3.13.11.11
Uname: Linux 3.13.0-43-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.6
Architecture: amd64
CurrentDesktop: Unity
Date: Sat Dec 20 23:51:03 2014
InstallationDate: Installed on 2014-12-19 (0 days ago)
InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140722.2)
SourcePackage: gstreamer1.0
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Sergey "Shnatsel" Davidoff <unprivileged account> (shnatsel-unprivileged) wrote :
Revision history for this message
Sergey "Shnatsel" Davidoff (shnatsel) wrote :

This was fixed by Sebastian Droge with these commits:
http://cgit.freedesktop.org/gstreamer/gstreamer/commit/plugins/elements/gstmultiqueue.c?id=afcc93254b929e9938d9b7f5578fc533f7d6ae3e
http://cgit.freedesktop.org/gstreamer/gstreamer/commit/plugins/elements/gstmultiqueue.c?id=3032a369a7c42e77ecda7b4b08287865c52e3e64
earlier this year in August.

He has also applied the same fix to the queue and queue2 elements:
http://cgit.freedesktop.org/gstreamer/gstreamer/commit/plugins/elements/gstqueue.c?id=6a261b1fc28e4446f136131c686ff3530ba86ee5
http://cgit.freedesktop.org/gstreamer/gstreamer/log/plugins/elements/gstqueue2.c

It's all fixed since the 1.4.1 release, but not in any 1.2 release.

These patches should probably be backported.

Revision history for this message
Sergey "Shnatsel" Davidoff (shnatsel) wrote :

Upstream does not consider this a security vulnerability. Disclosing and unmarking private.

information type: Private Security → Public
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.