CVE-2022-21722
📋 TL;DR
CVE-2022-21722 is an out-of-bounds read vulnerability in PJSIP multimedia communication library affecting versions 2.11.1 and prior. This allows attackers to potentially read sensitive memory contents or cause denial of service by sending specially crafted RTP/RTCP packets. All users who use PJMEDIA and accept incoming RTP/RTCP traffic are affected.
💻 Affected Systems
- PJSIP
- pjproject
- applications using PJSIP library
📦 What is this software?
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though out-of-bounds read typically results in information disclosure or crash.
Likely Case
Denial of service causing service disruption or information disclosure through memory leaks.
If Mitigated
Limited impact with proper network segmentation and packet filtering in place.
🎯 Exploit Status
Exploitation requires sending specially crafted RTP/RTCP packets to vulnerable endpoints. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Master branch commit 22af44e68a0c7d190ac1e25075e1382f77e9397a and later
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36
Restart Required: Yes
Instructions:
1. Update to latest PJSIP version from master branch. 2. Recompile applications using PJSIP. 3. Restart affected services. 4. Verify patch application with version check.
🔧 Temporary Workarounds
Network segmentation and filtering
linuxRestrict RTP/RTCP traffic to trusted sources only using firewall rules
iptables -A INPUT -p udp --dport 16384:32768 -s trusted_ip -j ACCEPT
iptables -A INPUT -p udp --dport 16384:32768 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy intrusion detection/prevention systems to monitor for anomalous RTP/RTCP traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check PJSIP version: pkg-config --modversion pjproject or examine application dependenciesCheck Version:
pkg-config --modversion pjproject || grep 'PJ_VERSION' in source codeVerify Fix Applied:
Verify version is newer than 2.11.1 or includes commit 22af44e68a0c7d190ac1e25075e1382f77e9397a📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unusual RTP/RTCP packet size logs
Network Indicators:
- Malformed RTP/RTCP packets
- Unusual traffic patterns to RTP ports
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "out of bounds" OR "memory violation")🔗 References
- https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a
- https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
- https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a
- https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
