CVE-2020-10573: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in Janus through 0.9.1, identified as CVE-2020-10573. The vulnerability involves a double mutex unlock condition that occurs when listing private rooms in the AudioBridge component, specifically in the janus_audiobridge.c file. The vulnerability was discovered and disclosed on March 14, 2020 (NVD).

The vulnerability stems from a double unlock operation that could occur when sending a "list" request to an AudioBridge instance hosting private rooms. While iterating through all rooms, there was an unnecessary unlock for the room mutex in case a room was private. This was identified as a leftover from previous refactoring where mutexes were relied upon to ensure room instance validity (Janus PR).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating potential high impact on system availability (NVD).

The issue was fixed in version 0.9.2 by removing the unnecessary unlock operation. The fix involves increasing the reference to the room and decreasing it when done, with the whole process being wrapped in rooms_mutex (Janus PR).