CVE-2020-14212: 
Ffmpeg vulnerability analysis and mitigation

FFmpeg through version 4.3 contains a heap-based buffer overflow vulnerability (CVE-2020-14212) in the avio_get_str function within libavformat/aviobuf.c. The vulnerability occurs because dnn_backend_native.c calls ff_dnn_load_model_native and omits a certain index check (CVE, Rapid7).

The vulnerability is caused by a missing check of the operand_index variable while accessing network->operands and setting the name in dnn_backend_native.c. This leads to a heap-based buffer overflow in the avio_get_str function. The issue has a CVSS score of 7.0 (AV:N/AC:M/Au:N/C:P/I:P/A:P), indicating moderate severity with network vector attack potential (Rapid7).

The vulnerability could result in a read buffer overflow that may be used as a primitive to leak addresses or sensitive memory. This could potentially lead to arbitrary code execution or system crashes (FFmpeg Trac).

The vulnerability can be triggered through a specially crafted model file that exploits the missing index check. A proof of concept has been demonstrated using a manually crafted native model file that triggers the buffer overflow (FFmpeg Trac).

The issue was fixed in FFmpeg version 4.2.4 and later releases. Users should upgrade to a patched version. The fix was implemented through a patch that adds proper index checking, as documented in the FFmpeg patchwork (Gentoo, FFmpeg Patchwork).