CVE-2020-22033: 
Ffmpeg vulnerability analysis and mitigation

A heap-based Buffer Overflow Vulnerability was discovered in FFmpeg 4.2, specifically in the libavfilter/vf_vmafmotion.c file within the convolution_y_8bit function. The vulnerability was assigned CVE-2020-22033 and was publicly disclosed in May 2021 (NVD).

The vulnerability exists in the convolution_y_8bit function of FFmpeg's vmafmotion filter. When exploited, it can cause a write of size 2 at an unauthorized memory location, specifically 32 bytes to the left of a 64-byte allocated region. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

If successfully exploited, this vulnerability could allow a remote malicious user to cause a Denial of Service (DoS) condition in the affected system. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires user interaction and can be triggered by processing specially crafted input files. A proof of concept exists demonstrating the heap buffer overflow in the vmafmotion filter when processing specific video content (FFmpeg Ticket).

The vulnerability has been fixed in multiple distributions. Debian has addressed this in version 7:4.1.8-0+deb10u1 for the oldstable distribution (buster). Ubuntu has also released fixes for various versions: 7:4.4.2-0ubuntu0.21.10.1 (21.10), 7:4.2.7-0ubuntu0.1 (20.04 LTS), and 7:3.4.11-0ubuntu0.1 (18.04 LTS) (Debian Security, Ubuntu Security).