Patch Ticker

GStreamer good plugins H.264 RTP parser flaw can crash servers or leak memory

A Linux video component can crash or leak memory from one malformed data chunk.

Summary

The H.264 RTP depayloader in GStreamer reads outside its memory bounds when it handles truncated MTAP16 or MTAP24 data. A remote unauthenticated attacker can use one malformed packet to crash the receiving pipeline or expose adjacent memory. Red Hat's record lists RHEL 10 as affected and RHEL 7, 8 and 9 as unaffected.

Affected when

  • GStreamer pipeline receiving H.264 RTP streams

What to do

Red Hat's record lists RHEL 10 as affected and RHEL 7, 8 and 9 as unaffected. No fixed version is named in the sources, so check Red Hat's advisory for a gstreamer1-plugins-good update.

Products and platforms

  • Linux
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

CVE IDs

Sources

Times

First published

First seen