CVE-2022-31003: Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP

Vulnerability summary

CVE-2022-31003 is a critical (CVSS 9.8) Heap-based Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 4.11% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-05-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.

• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.