CVE-2020-22048: 
Ffmpeg vulnerability analysis and mitigation

A Denial of Service vulnerability (CVE-2020-22048) was discovered in FFmpeg version 4.2 due to a memory leak in the ff_frame_pool_get function located in framepool.c. The vulnerability was disclosed in 2020 and affects FFmpeg multimedia framework (FFmpeg Ticket, Debian LTS).

The vulnerability stems from a memory leak in the ff_frame_pool_get function within framepool.c. When triggered, the issue causes memory to be allocated but not properly freed, leading to resource exhaustion. The vulnerability was confirmed through Valgrind analysis which showed definitely lost memory blocks of 1,072 bytes directly and 99,642 bytes indirectly during execution (FFmpeg Ticket).

The vulnerability can result in Denial of Service conditions through resource exhaustion due to memory leaks. When exploited, it can cause the application to consume increasing amounts of memory over time, potentially leading to system instability or crashes (Debian LTS).

The vulnerability can be triggered through the processing of multimedia files using FFmpeg's frame pool functionality. A proof of concept exists demonstrating the memory leak through specific video processing operations using the colorspace filter (FFmpeg Ticket).

The issue has been addressed in subsequent patches and updates. For Debian 9 (Stretch), the fix was included in version 7:3.2.16-1+deb9u1. Users are recommended to upgrade their FFmpeg installations to patched versions (Debian LTS).