CVE-2022-43240: 
NixOS vulnerability analysis and mitigation

CVE-2022-43240 affects Libde265 version 1.0.8, which contains a heap-buffer-overflow vulnerability in the ff_hevc_put_hevc_qpel_h_2_v_1_sse function within sse-motion.cc. This vulnerability was discovered in October 2022 and allows attackers to cause a Denial of Service (DoS) via a crafted video file (Github Issue, NVD).

The vulnerability is classified as a heap-buffer-overflow that occurs in the ff_hevc_put_hevc_qpel_h_2_v_1_sse function located in sse-motion.cc. The CVSS v3.1 base score is 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue is categorized under CWE-787 (Out-of-bounds Write) (NVD).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) through a specially crafted video file. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD, Github Issue).

The vulnerability can be triggered by processing a specially crafted video file. A proof of concept (PoC) exploit has been published and is available in the FDU-Sec repository (Github Issue).

Multiple distributions have released patches to address this vulnerability. Debian has released security updates in version 1.0.11-0+deb11u1 for the stable distribution (bullseye) and version 1.0.3-1+deb10u2 for Debian 10 (buster) (Debian Advisory, Debian LTS).