CVE-2020-22038: Medium severity FFmpeg FFmpeg vulnerability

Q: What is CVE-2020-22038?

CVE-2020-22038 is a Denial of Service vulnerability in FFmpeg 4.2.

Q: How severe is CVE-2020-22038?

CVE-2020-22038 has a severity score of 6.5 (medium).

Q: Which version of FFmpeg is affected by CVE-2020-22038?

FFmpeg version 4.2 is affected by CVE-2020-22038.

Q: What is the impact of CVE-2020-22038?

CVE-2020-22038 can allow an attacker to cause a Denial of Service by exploiting a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.

Q: Are there any known remedies for CVE-2020-22038?

Remedies include updating to Ubuntu versions 4.4, 7:3.4.11-0ubuntu0.1+, 7:4.2.7-0ubuntu0.1+, or Debian versions 7:5.1.3-1, 7:6.0-7.

Published Jun 1, 2021

Updated

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ffv4l2m2mcreatecontext function in v4l2m2m.c.

Affected Software

23 affected componentsFixes available

ubuntu/ffmpeg<7:3.4.11-0ubuntu0.1+

7:3.4.11-0ubuntu0.1+

ubuntu/ffmpeg<7:4.2.7-0ubuntu0.1+

7:4.2.7-0ubuntu0.1+

ubuntu/ffmpeg<4.4

4.4

debian/ffmpeg<=7:4.1.9-0+deb10u1, <=7:4.1.11-0+deb10u1, <=7:4.3.6-0+deb11u1

7:5.1.4-0+deb12u17:6.1.1-1

FFmpeg FFmpeg=4.2

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

alpine/ffmpeg4<4.4-r0

4.4-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:3.4.11-0ubuntu0.1+
Upgrade
Upgrade ubuntu/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.2.7-0ubuntu0.1+
Upgrade
Upgrade ubuntu/ffmpeg to a version that resolves this vulnerability.
Fixed in 4.4
Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:5.1.4-0+deb12u1Fixed in 7:6.1.1-1
Upgrade
Upgrade alpine/ffmpeg to a version that resolves this vulnerability.
Fixed in 4.4-r0
Upgrade
Upgrade alpine/ffmpeg4 to a version that resolves this vulnerability.
Fixed in 4.4-r0

Event History

Jun 1, 2021

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·07:25 PM

Data Sourced

via MITRE·07:25 PM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·08:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

USN-6449-1

Frequently Asked Questions

What is CVE-2020-22038?

CVE-2020-22038 is a Denial of Service vulnerability in FFmpeg 4.2.

How severe is CVE-2020-22038?

CVE-2020-22038 has a severity score of 6.5 (medium).

Which version of FFmpeg is affected by CVE-2020-22038?

FFmpeg version 4.2 is affected by CVE-2020-22038.

What is the impact of CVE-2020-22038?

CVE-2020-22038 can allow an attacker to cause a Denial of Service by exploiting a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.

Are there any known remedies for CVE-2020-22038?

Remedies include updating to Ubuntu versions 4.4, 7:3.4.11-0ubuntu0.1+, 7:4.2.7-0ubuntu0.1+, or Debian versions 7:5.1.3-1, 7:6.0-7.

CVE-2020-22038: Medium severity FFmpeg FFmpeg vulnerability

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2020-22038?

How severe is CVE-2020-22038?

Which version of FFmpeg is affected by CVE-2020-22038?

What is the impact of CVE-2020-22038?

Are there any known remedies for CVE-2020-22038?

Company

Resources

Contact