CVE-2022-31001: Out-of-bounds Read in Sofia-SIP
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by #define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0), which will make n bigger and trigger out-of-bound access when ISNONWS(s[n]). Version 1.13.8 contains a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-31001?
CVE-2022-31001 is a vulnerability in the Sofia-SIP open-source Session Initiation Protocol (SIP) User-Agent library.
What is the severity of CVE-2022-31001?
CVE-2022-31001 has a severity level of high, with a severity value of 7.5.
How does CVE-2022-31001 impact FreeSWITCH?
CVE-2022-31001 allows an attacker to send a message with evil SDP to FreeSWITCH, potentially causing a crash.
What is the affected software for CVE-2022-31001?
The affected software for CVE-2022-31001 includes the Sofia-SIP package in Debian Linux versions 10.0, as well as the Signalwire Sofia-sip package up to version 1.13.8.
How can I fix CVE-2022-31001?
To fix CVE-2022-31001, users should update to the patched versions of the affected software packages provided by the respective vendors.