CVE-2024-10573 Mpg123: buffer overflow when writing decoded pcm samples
An out-of-bounds write in libmpg123 allows arbitrary code execution via crafted streams, requiring user interaction to scan the stream.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-10573?
CVE-2024-10573 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 7, published on 31 Oct 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.
Weakness: CWE-787
Which versions are affected by CVE-2024-10573?
Linux distribution packages (35)
mpg123 AlmaLinux:8 | All versions | 1.32.9-1.el8_10 |
mpg123-devel AlmaLinux:8 | All versions | 1.32.9-1.el8_10 |
mpg123-libs AlmaLinux:8 | All versions | 1.32.9-1.el8_10 |
mpg123-plugins-pulseaudio AlmaLinux:8 | All versions | 1.32.9-1.el8_10 |
mpg123 AlmaLinux:9 | All versions | 1.32.9-1.el9_5 |
mpg123-devel AlmaLinux:9 | All versions | 1.32.9-1.el9_5 |
mpg123-libs AlmaLinux:9 | All versions | 1.32.9-1.el9_5 |
mpg123-plugins-pulseaudio AlmaLinux:9 | All versions | 1.32.9-1.el9_5 |
mpg123 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-plugins-pulseaudio Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-plugins-pulseaudio-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.32.9-1.el8_10 |
mpg123-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.32.9-1.el8_10 |
mpg123-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.32.9-1.el8_10 |
mpg123-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.32.9-1.el8_10 |
mpg123-libs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.32.9-1.el8_10 |
mpg123-plugins-pulseaudio-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.32.9-1.el8_10 |
mpg123 Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-plugins-pulseaudio Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-plugins-pulseaudio-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.32.9-1.el9_5 |
mpg123-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:1.32.9-1.el9_5 |
mpg123-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:1.32.9-1.el9_5 |
mpg123-devel Red Hat:enterprise_linux:9::crb | All versions | 0:1.32.9-1.el9_5 |
mpg123-libs-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:1.32.9-1.el9_5 |
mpg123-plugins-pulseaudio-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:1.32.9-1.el9_5 |
mpg123 Rocky Linux:8 | All versions | 0:1.32.9-1.el8_10 |
mpg123 Rocky Linux:9 | All versions | 0:1.32.9-1.el9_5 |
mpg123 openSUSE:Tumbleweed | All versions | 1.32.9-1.1 |
How do I fix CVE-2024-10573?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-10573 being exploited?
There is no known exploitation of CVE-2024-10573 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-10573, ALSA-2024:11193, ALSA-2024:11242, CLSA-2026-1779694248, DEBIAN-CVE-2024-10573, DLA-3967-1 and 11 more.