TI-2022-13047 Aliases CVE-2022-31001

Out-of-bounds Read in Sofia-SIP

LOW 37CWE-125Published 2022-05-31 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.

Why it matters now

EPSS 0.0222 82nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed sofia-sip (freeswitch): 1.13.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
freeswitch	sofia-sip	before 1.13.8	1.13.8	Patch available	CNA

sofia-sip Vendorfreeswitch Affected before 1.13.8 Fixed in 1.13.8 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:signalwire:sofia-sip::::::::	before 1.13.8	Vulnerable	signalwire
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:* Versions before 1.13.8 Vulnerable ·signalwire
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Fix · CNA sofia-sip (freeswitch) Fixed in 1.13.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-05-31
freeswitch sofia-sip — GLSA-202210-18
3 records Highest priority Priority HIGH 2 HIGH, 1 LOW
Other records, highest priority first
- TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIPPriority HIGH 81
- TI-2022-13048 Out-of-bounds Read in Sofia-SIPPriority HIGH 72
Show all 3 records → Advisory →
Advisory · 2022-05-31
freeswitch sofia-sip — DSA-5410
3 records Highest priority Priority HIGH 2 HIGH, 1 LOW
Other records, highest priority first
- TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIPPriority HIGH 81
- TI-2022-13048 Out-of-bounds Read in Sofia-SIPPriority HIGH 72
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-31001

References

Exploit 1

https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9g

Patch 1

https://github.com/freeswitch/sofia-sip/commit/a99804b336d0e16d26ab7119d56184d2d7110a36

Advisory 3

TI-2023-08915 heap-over-flow in stun_parse_attribute in sofia-sip CVSS 3.1CRITICAL 9.8
TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVSS 3.1CRITICAL 9.8
TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
TI-2023-15601 heap-over-flow and integer-overflow in sofia-sip CVSS 3.1HIGH 7.5

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences