CVE-2023-32570 Race condition in n/a
A race condition in the dav1d AV1 decoder library allows attackers to cause an application crash via crafted video files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32570?
CVE-2023-32570 is a medium-severity vulnerability in Fedoraproject Fedora, published on 10 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.
Weakness: CWE-362
Which versions are affected by CVE-2023-32570?
It affects 2 products.
Linux distribution packages (3)
dav1d SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 1.0.0-150500.3.3.1 |
dav1d SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 1.0.0-150500.3.3.1 |
dav1d openSUSE:Leap 15.5 | All versions | 1.0.0-150500.3.3.1 |
Products include Fedoraproject Fedora, Videolan Dav1d.
How do I fix CVE-2023-32570?
Upgrade to a fixed version.
Is CVE-2023-32570 being exploited?
There is no known exploitation of CVE-2023-32570 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BELL-CVE-2023-32570, DEBIAN-CVE-2023-32570, ECHO-ca6c-4314-8dc3, GHSA-6q7w-3rwf-fh47, ROOT-OS-DEBIAN-12-CVE-2023-32570, SUSE-SU-2023:2618-1 and 2 more.