CVE-2021-41145
📋 TL;DR
CVE-2021-41145 is a denial-of-service vulnerability in FreeSWITCH where flooding the system with SIP messages causes memory exhaustion and crashes. This affects all FreeSWITCH instances prior to version 1.10.7, allowing unauthenticated attackers to disrupt telecom services.
💻 Affected Systems
- FreeSWITCH
📦 What is this software?
Freeswitch by Freeswitch
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of FreeSWITCH telecom services, disrupting voice, video, and messaging communications for all users.
Likely Case
Service disruption and downtime requiring manual restart of FreeSWITCH processes, impacting call routing and telecom operations.
If Mitigated
Limited impact with proper network segmentation and rate limiting, potentially causing temporary performance degradation but preventing complete outage.
🎯 Exploit Status
Simple SIP flooding tools can exploit this vulnerability. No authentication required and attack works over multiple transport protocols.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.7
Vendor Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download FreeSWITCH 1.10.7 or later from official repository. 3. Stop FreeSWITCH service. 4. Install new version. 5. Restart FreeSWITCH service. 6. Verify functionality.
🔧 Temporary Workarounds
Network Rate Limiting
linuxImplement rate limiting on SIP traffic using network devices or firewalls
# Example iptables rule for SIP rate limiting
iptables -A INPUT -p udp --dport 5060 -m state --state NEW -m recent --set
iptables -A INPUT -p udp --dport 5060 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP
Network Segmentation
linuxRestrict SIP traffic to trusted sources only using firewall rules
# Allow SIP only from specific IP ranges
iptables -A INPUT -p udp --dport 5060 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit SIP traffic to trusted sources only
- Deploy intrusion prevention systems (IPS) with SIP flood detection capabilities
🔍 How to Verify
Check if Vulnerable:
Check FreeSWITCH version: freeswitch -version. If version is earlier than 1.10.7, system is vulnerable.Check Version:
freeswitch -versionVerify Fix Applied:
After patching, verify version is 1.10.7 or later and monitor system memory usage during normal SIP traffic.📡 Detection & Monitoring
Log Indicators:
- Rapid increase in SIP message processing
- Memory exhaustion warnings in system logs
- FreeSWITCH process crashes or restarts
Network Indicators:
- Unusually high volume of SIP traffic from single or multiple sources
- SIP flood patterns in network traffic
SIEM Query:
source="freeswitch.log" ("memory" AND "exhaust") OR ("SIP" AND "flood") OR ("crash" AND "process")