Skip to content

Remote attackers can cause a denial of service with a crafted UDP message

High
andywolk published GHSA-h94r-c3pv-4564 Feb 23, 2023

Package

sofia-sip (C)

Affected versions

1.13.13

Patched versions

1.13.14

Description

Remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.

Update to sofia-sip >= 1.13.14 to remove the vulnerability.

The issue was initially reported to another project drachtio/drachtio-server#244
and fixed in the fork davehorton/sofia-sip@13b2a13

tport_t *tport_tsend(tport_t *self,
                     msg_t *msg,
                     tp_name_t const *_tpn,
                     tag_type_t tag, tag_value_t value, ...)
{
[...]

  assert(self); // should not assert here when there's    if (!self) right below
handling that gracefully

  if (!self || !msg || !_tpn) {
    msg_set_errno(msg, EINVAL);
    return NULL;
  }
[...]
}

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID

CVE-2022-47516

Weaknesses