GHSA-v7mq-h638-6fxp: FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect() passed the first RTMP connect argument to amf0objectget() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled modrtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Only FreeSWITCH deployments with a mod_rtmp listener enabled are exposed to network clients that can reach that listener. The module is disabled in the stock build and configuration.
Does an attacker need credentials or an active session?
No. A client can send the malformed RTMP connect command before login, so no authentication or prior session is required.
What is the practical impact of exploitation?
The invalid read reliably crashes FreeSWITCH and terminates every active call. The available information does not demonstrate memory disclosure, writes, or code execution.
What can be done if an immediate upgrade is not possible?
Disable mod_rtmp or prevent untrusted network clients from reaching its listener. This removes the pre-authentication network path described for the issue.
How can I remediate the issue?
Upgrade FreeSWITCH to version 1.11.2, which contains the fix.