CVE-2023-24758: 
NixOS vulnerability analysis and mitigation

CVE-2023-24758 affects libde265 version 1.0.10, which is an open H.265 video codec implementation. The vulnerability was discovered and disclosed in January 2023, involving a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc (CVE-MITRE, Debian-LTS).

The vulnerability stems from a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function located in the sse-motion.cc file. The issue occurs when processing crafted input files, specifically during video codec operations (GitHub-Issue).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) by processing specially crafted input files. The impact is primarily focused on system availability, as the NULL pointer dereference leads to application crashes (NVD).

The vulnerability can be triggered by processing a specially crafted input file. A proof of concept (PoC) has been documented that demonstrates the exploitation path through the video codec processing pipeline (GitHub-Issue).

Multiple vendors have released patches to address this vulnerability. Ubuntu has updated their packages (libde265-0) across various versions, including Ubuntu 22.04 (1.0.8-1ubuntu0.2) and Ubuntu 20.04 (1.0.4-1ubuntu0.3). Debian has also released security updates, with version 1.0.11-0+deb10u4 for Debian 10 addressing the vulnerability (Ubuntu-Security, Debian-LTS).