Junglewise Threat Intelligence

CVE-2016-9446: GStreamer information disclosure in VMNC decoder

CVE-2016-9446 · Severity: high · CVSS 7.5 · Published 2017-01-23

Executive brief

GStreamer is a widely used multimedia framework that handles audio and video processing on Linux and other platforms. A vulnerability in its VMNC video decoder allows an attacker to potentially view sensitive information from a system's memory. This occurs when the software creates a thumbnail or processes a specially crafted video file, which could lead to the exposure of private data to unauthorized parties.

Technical details

The vulnerability exists in the VMNC decoder within the GStreamer 'gst-plugins-bad' package. The root cause is a failure to initialize the render canvas buffer after allocation; the decoder uses g_malloc(), which is a wrapper for malloc() and does not zero-out or initialize the returned memory. An attacker can exploit this by providing a single-frame VMNC movie that does not draw to the allocated canvas. When the system attempts to process this file (e.g., during automatic thumbnail generation), the uninitialized heap memory—which may contain sensitive data from previous allocations—is leaked into the resulting output. This was patched in GStreamer version 1.11.1.

Affected products

  • GStreamer Project GStreamer versions before 1.11.1

Timeline

  • 2016-11-18: disclosed: Public disclosure by Chris Evans (ScaryBeast)
  • 2016-11-18: patched: Fix committed to upstream GStreamer repository
  • 2017-01-23: advisory: NVD publication date

References