CVE-2021-43845
📋 TL;DR
CVE-2021-43845 is an out-of-bounds read vulnerability in PJSIP multimedia communication library versions 2.11.1 and earlier. A malicious actor can send specially crafted RTCP XR messages with invalid packet sizes, potentially causing memory corruption or information disclosure. This affects all users of PJMEDIA with RTCP XR functionality enabled.
💻 Affected Systems
- PJSIP (pjproject)
- Any software using PJSIP library
📦 What is this software?
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though out-of-bounds read typically results in information disclosure or denial of service.
Likely Case
Application crash leading to denial of service, or information disclosure from memory contents.
If Mitigated
Minimal impact if proper network segmentation and input validation are in place.
🎯 Exploit Status
The vulnerability is in the parsing logic, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12 and later
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh
Restart Required: Yes
Instructions:
1. Update PJSIP to version 2.12 or later. 2. Recompile any applications using PJSIP. 3. Restart affected services.
🔧 Temporary Workarounds
Disable RTCP XR
allDisable RTCP XR functionality if not required.
Configure PJSIP to disable RTCP XR in application settings
Network filtering
linuxBlock or filter RTCP XR packets at network perimeter.
iptables -A INPUT -p udp --dport [rtcp-port] -m string --hex-string '|52544350|' --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy intrusion detection systems to monitor for malformed RTCP packets
🔍 How to Verify
Check if Vulnerable:
Check PJSIP version and verify RTCP XR is enabled in configuration.Check Version:
pjsua --version or check library version in applicationVerify Fix Applied:
Verify PJSIP version is 2.12 or later and test with valid RTCP XR packets.📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unexpected RTCP packet processing errors
Network Indicators:
- Malformed RTCP XR packets
- Unusual RTCP traffic patterns
SIEM Query:
source="*pjsip*" AND (error OR crash OR "out of bounds" OR "memory violation")🔗 References
- https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859
- https://github.com/pjsip/pjproject/pull/2924
- https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
- https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859
- https://github.com/pjsip/pjproject/pull/2924
- https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
