Attack Chain

1. An attacker establishes a connection with a target process over a unixfd transport.
2. The attacker sends a serialized GstVideoMeta structure containing intentionally oversized or negative plane strides.
3. The target receiver deserializes the malicious meta-data without performing range checks against the backing buffer size.
4. The target process maps the frame, with default_map() failing to validate the geometry against the actual memory allocation.
5. During subsequent processing (e.g., in videoconvert), the system performs memcpy or ORC kernel operations based on the attacker-controlled strides.
6. Memory operations occur outside the buffer boundaries, resulting in either a crash (read) or corruption of adjacent heap objects (write).
7. The attacker leverages the write primitive to overwrite function pointers in a neighbouring GstMiniObject.
8. The application is triggered to call the corrupted pointer, redirecting control flow to attacker-supplied logic (e.g., system()).

Impact

Confirmed impact includes out-of-bounds information disclosure and heap-based memory corruption. Demonstrations indicate potential for arbitrary code execution in pipelines that accept video buffers over unixfd from untrusted sources, particularly sandboxed decoders or portal-style privilege-boundary pipelines.

Recommendation

• Inventory systems utilizing GStreamer unixfdsrc elements, specifically those handling media frames across process or privilege boundaries.
• Apply security patches to GStreamer and dependent projects as soon as vendors release updates addressing the three validation points identified in the advisory: plane extent checks in default_map(), validation in the meta branch of gst_video_frame_map_id(), and range checks in video_meta_deserialize().
• Isolate media processing pipelines that consume data from untrusted sources to minimize the impact of potential memory corruption.