Unchecked Return Value in FFmpeg - CVE-2021-38114

Vulnerability identifier: #VU92207

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-38114

CWE-ID: CWE-252

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to libavcodec/dnxhddec.c in FFmpeg does not check the return value of the init_vlc function. A local user can trick the victim into opening a specially crafted file to trigger resource exhaustion and perform a denial of service (DoS) attack.

FFmpeg
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
Cisco Jabber
openEuler
Cisco Webex Meetings
VMware Horizon Client
ffmpeg
ffmpeg-debuginfo
ffmpeg-debugsource
libavdevice
ffmpeg-devel
ffmpeg-libs

Install updates from vendor's website.

Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
ffmpeg - update to 4.2.4-4
ffmpeg-debuginfo - update to 4.2.4-4
ffmpeg-debugsource - update to 4.2.4-4
libavdevice - update to 4.2.4-4
ffmpeg-devel - update to 4.2.4-4
ffmpeg-libs - update to 4.2.4-4

• https://github.com/FFmpeg/FFmpeg/commit/7150f9575671f898382c370acae35f9087a30ba1
• https://patchwork.ffmpeg.org/project/ffmpeg/patch/PAXP193MB12624C21AE412BE95BA4D4A4B6F09@PAXP193MB1262.EURP193.PROD.OUTLOOK.COM/
• https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html
• https://www.debian.org/security/2021/dsa-4990
• https://www.debian.org/security/2021/dsa-4998

• Multiple vulnerabilities in Dell ThinOS
• openEuler update for ffmpeg