CVE-2022-24793 Potential heap buffer overflow when parsing DNS packets in PJSIP
Heap buffer overflow in PJSIP DNS parsing allows attackers to execute code or cause denial of service in applications using internal DNS resolution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24793?
CVE-2022-24793 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 6 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.
Weakness: CWE-120
Which versions are affected by CVE-2022-24793?
It affects 2 products.
Products include Debian Debian Linux, Pjsip Pjsip.
How do I fix CVE-2022-24793?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-24793 being exploited?
There is no known exploitation of CVE-2022-24793 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-24793, DEBIAN-CVE-2022-24793, GHSA-p6g5-v97c-w5q4, UBUNTU-CVE-2022-24793.