Bug 2153551 (CVE-2022-3109)

Summary:	CVE-2022-3109 FFmpeg: Null Pointer Dereference
Product:	[Other] Security Response	Reporter:	Sage McTaggart <amctagga>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ajak, asn, dominik, kde-sig, kevin, ngompa13, rdieter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	FFmpeg 5.1	Doc Type:	---
Doc Text:	An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	2154846, 2154848, 2154844, 2154847
Bug Blocks:	2153552

Description Sage McTaggart 2022-12-14 18:31:00 UTC

[Suggested description]
An issue was discovered in the FFmpeg through 3.0. vp3_decode_frame in
libavcodec/vp3.c lacks check of the return value of av_malloc() and
will cause the null pointer dereference.

------------------------------------------

[VulnerabilityType Other]
NULL Pointer Dereference

------------------------------------------

[Vendor of Product]
the development group

------------------------------------------

[Affected Product Code Base]
FFmpeg - 3.0

------------------------------------------

[Reference]
https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568

------------------------------------------

[Discoverer]
Jiasheng Jiang

Comment 1 Neal Gompa 2022-12-15 02:23:38 UTC

This was actually fixed in FFmpeg 5.1.

Comment 2 John Helmert III 2022-12-17 21:36:31 UTC

I've sent the following mail to secalert AT redhat.com:

"Hi, CVE-2022-3109 should be updated to say the vulnerable versions are
<5.1. Claiming that "ffmpeg though 3.0" is affected softly implies
that a version soon after 3.0 contains a fix for the vulnerability,
but that is not the case since the patch made it into ffmpeg-5.1.

The CVE description also claims that the bug affect
confidentiality. How does a null pointer dereference affect
confidentiality?"

Comment 3 Marian Rehak 2022-12-19 11:54:57 UTC

Created ffmpeg tracking bugs for this issue:

Affects: fedora-36 [bug 2154844]


Created qt5-qtwebengine tracking bugs for this issue:

Affects: epel-8 [bug 2154846]
Affects: fedora-36 [bug 2154847]
Affects: fedora-37 [bug 2154848]