CVE-2020-22019: 
Ffmpeg vulnerability analysis and mitigation

CVE-2020-22019 is a Buffer Overflow vulnerability discovered in FFmpeg 4.2, specifically in the convolution_y_10bit function within libavfilter/vf_vmafmotion.c. The vulnerability was disclosed on May 26, 2021, affecting FFmpeg version 4.2 and its integration in various Linux distributions (NVD, CVE).

The vulnerability is classified as a heap-buffer-overflow occurring at line 180 in libavfilter/vf_vmafmotion.c during the convolution_y_10bit operation. It has been assigned a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating network accessibility with required user interaction (NVD).

When exploited, this vulnerability could allow a remote malicious user to cause a Denial of Service (DoS) condition in the affected system. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (Ubuntu).

The vulnerability requires user interaction to be exploited, as demonstrated through proof-of-concept code that triggers the heap-buffer-overflow. The issue was confirmed through ASAN (Address Sanitizer) testing with specific input parameters (FFmpeg Ticket).

The vulnerability has been fixed in various distribution releases. Debian has addressed it in version 7:4.1.8-0+deb10u1 for the oldstable distribution (buster). Ubuntu has provided fixes for multiple versions including 20.04 LTS (focal) with version 7:4.2.7-0ubuntu0.1 and 18.04 LTS (bionic) with version 7:3.4.11-0ubuntu0.1 (Debian Advisory, Ubuntu).