Vulners
Lucene search
Shannon Baseband fmtp SDP Attribute Memory Corruption
🗓️ 04 May 2023 00:00:00Reported by Google Security Research, natashenkaType 
packetstorm🔗 packetstormsecurity.com👁 363 Views
| Reporter | Title | Published | Views | Family All 45 |
|---|---|---|---|---|
 | CVE-2022-26496 | 6 Mar 202206:15 | – | attackerkb |
 | CVE-2022-26496 | 6 Mar 202200:00 | – | alpinelinux |
 | Astra Linux - уязвимость в nbd | 20 May 202605:53 | – | astralinux |
 | nbd 缓冲区错误漏洞 | 6 Mar 202200:00 | – | cnnvd |
 | nbd buffer overflow vulnerability | 8 Mar 202200:00 | – | cnvd |
 | CVE-2022-26496 | 6 Mar 202200:00 | – | cve |
 | CVE-2022-26496 | 6 Mar 202200:00 | – | cvelist |
 | [SECURITY] [DSA 5100-1] nbd security update | 12 Mar 202216:00 | – | debian |
 | CVE-2022-26496 | 6 Mar 202200:00 | – | debiancve |
 | Debian DSA-5100-1 : nbd - security update | 14 Mar 202200:00 | – | nessus |
10
`Shannon Baseband: Memory corruption when processing fmtp SDP attribute
There is a memory corruption vulnerability that occurs when the baseband modem processes SDP when setting up a call. When an fmtp attribute is parsed, the integer that represents the payload type is copied into an 8-byte buffer using memcpy with the length of payload type as the length parameter. There are no checks that the payload type is less than 8-bytes long or actually an integer.
I was not able to reproduce this bug, as most carrier SIP servers filter SDP that contains this error, however there is still risk that some servers won't filter this SDP, or a server gets compromised.
A sample line of SDP that causes the problem is as follows:
a=fmtp:1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA00 0-15
This bug is subject to a 90-day disclosure deadline. If a fix for this
issue is made available to users before the end of the 90-day deadline,
this bug report will become public 30 days after the fix was made
available. Otherwise, this bug report will become public at the deadline.
The scheduled deadline is 2023-03-19.
Related CVE Numbers: CVE-2022-26496.
Found by: [email protected]
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 May 2023 00:00Current
6.9Medium risk
Vulners AI Score6.9
CVSS 27.5
CVSS 3.19.8
EPSS0.00422