CVE-2019-5163
📋 TL;DR
This vulnerability allows remote attackers to cause a denial-of-service in Shadowsocks-libev by sending arbitrary UDP packets when using Stream Cipher with local_address configuration. The service will crash with a FATAL error, disrupting proxy functionality. Anyone running vulnerable versions of Shadowsocks-libev with UDPRelay enabled is affected.
💻 Affected Systems
- Shadowsocks-libev
📦 What is this software?
Backports by Opensuse
Leap by Opensuse
Shadowsocks Libev by Shadowsocks
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption requiring manual restart, potentially affecting all users relying on the Shadowsocks proxy for network connectivity.
Likely Case
Service crashes and becomes unavailable until restarted, causing temporary loss of proxy service for connected clients.
If Mitigated
No impact if patched or if vulnerable configurations are not used.
🎯 Exploit Status
Exploitation requires sending crafted UDP packets to the vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.3 and later
Vendor Advisory: https://github.com/shadowsocks/shadowsocks-libev/releases
Restart Required: Yes
Instructions:
1. Update Shadowsocks-libev to version 3.3.3 or later. 2. Restart the Shadowsocks service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable UDPRelay
linuxDisable UDP relay functionality if not required
Edit Shadowsocks config to remove or comment UDP relay settings
Restart Shadowsocks service
Use AEAD Cipher
linuxSwitch from Stream Cipher to AEAD Cipher (like AES-256-GCM)
Edit config to use AEAD cipher method
Restart Shadowsocks service
🧯 If You Can't Patch
- Implement network filtering to block UDP traffic to Shadowsocks port from untrusted sources
- Use firewall rules to restrict access to Shadowsocks service to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check if running Shadowsocks-libev version 3.3.2 or earlier with UDPRelay enabled and Stream Cipher configured.Check Version:
ss-server --versionVerify Fix Applied:
Verify Shadowsocks-libev version is 3.3.3 or later and service remains running after receiving UDP traffic.📡 Detection & Monitoring
Log Indicators:
- FATAL error messages in Shadowsocks logs
- Service crash/restart events
Network Indicators:
- Unexpected UDP traffic spikes to Shadowsocks port
- Service unresponsive after UDP packets
SIEM Query:
source="shadowsocks.log" AND "FATAL" AND "UDPRelay"🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956
