CVE-2020-36138: 
Ffmpeg vulnerability analysis and mitigation

CVE-2020-36138 is a vulnerability discovered in FFmpeg version 4.3, specifically in the decode_frame function within libavcodec/tiff.c. The vulnerability allows remote attackers to cause a denial of service (DoS) through a NULL pointer dereference. The issue was discovered by 1vanChen of NSFOCUS Security Team and was later fixed (FFmpeg Commit).

The vulnerability stems from an uninitialized variable in the decodeframe function when handling tiled TIFF images. When s->istiled=1, the initialization of the variable stripdata is skipped, leading to a NULL pointer dereference in the ff_tget function. The issue has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can be exploited to cause a denial of service condition through application crashes. When successfully exploited, it affects the availability of the system processing TIFF images through FFmpeg, particularly when handling tiled TIFF files (Rapid7).

The vulnerability was fixed in commit 292e41ce650a7b5ca5de4ae87fff0d6a90d9fc97, which disallows striped and tiled TIFFs except for DNG files. The patch modifies the decode_frame function to properly handle these cases and prevent the NULL pointer dereference. Users should upgrade to a version of FFmpeg that includes this fix (FFmpeg Patch).