PT-2023-23880 · Videolan+3 · Dav1D+3

Victorien Le Couviour--Tuffet · Published 2023-05-09 · Updated 2025-08-12 · CVE-2023-32570

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VideoLAN dav1d versions prior to 1.2.0

Description The issue is related to a thread task.c race condition that can lead to an application crash. This condition is associated with the dav1d decode frame exit function.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the dav1d decode frame exit function until a patch is available.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2023-1906

ALT-PU-2024-2955

ALT-PU-2024-4636

CVE-2023-32570

ECHO-CA6C-4314-8DC3

OPENSUSE-SU-2024:13730-1

ROSA-SA-2024-2376

SUSE-SU-2023:2618-1

SUSE-SU-2023_2618-1

Affected Products

Alt Linux

Debian

Suse

Dav1D

References · 21

• https://osv.dev/vulnerability/CVE-2023-32570 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-32570 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:2618-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-32570 · Vendor Advisory
• https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2023-32570 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32570 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-32570 · Vendor Advisory
• https://security.gentoo.org/glsa/202310-05 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32570 · Security Note
• https://ubuntu.com/security/CVE-2023-32570 · Vendor Advisory
• https://t.me/cibsecurity/63723 · Telegram Post