CVE-2022-23608
📋 TL;DR
This CVE describes a use-after-free vulnerability in PJSIP library versions up to 2.11.1 that occurs in dialog set scenarios. When multiple UAC dialogs share a hash key, premature freeing can cause hash table corruption leading to undefined behavior including endless loops. Any application using vulnerable PJSIP versions for SIP communication is affected.
💻 Affected Systems
- PJSIP/pjproject library
- Asterisk PBX
- Other SIP-based applications using PJSIP
📦 What is this software?
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing service disruption through endless loops, potentially leading to complete service unavailability and resource exhaustion.
Likely Case
Service instability, intermittent crashes, or degraded performance in SIP communication systems during dialog forking scenarios.
If Mitigated
Minimal impact with proper monitoring and rapid incident response; potential brief service interruptions during exploitation attempts.
🎯 Exploit Status
Exploitation requires specific dialog set conditions but no authentication; detailed technical advisory available but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit db3235953baa56d2fb0e276ca510fefca751643f; next release after 2.11.1
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-ffff-m5fm-qm62
Restart Required: Yes
Instructions:
1. Update PJSIP to version containing commit db3235953baa56d2fb0e276ca510fefca751643f or later. 2. Recompile applications using PJSIP. 3. Restart all services using the patched library.
🔧 Temporary Workarounds
No known workarounds
allThe vulnerability has no known configuration-based workarounds according to the advisory
🧯 If You Can't Patch
- Implement network segmentation to isolate SIP services from untrusted networks
- Deploy rate limiting and SIP message validation to reduce attack surface
🔍 How to Verify
Check if Vulnerable:
Check PJSIP version: pkg-config --modversion pjproject or examine library version in application dependenciesCheck Version:
pkg-config --modversion pjproject 2>/dev/null || find /usr -name '*pjlib*' -exec strings {} \; | grep 'PJLIB_VERSION'Verify Fix Applied:
Verify PJSIP version is newer than 2.11.1 and contains commit db3235953baa56d2fb0e276ca510fefca751643f📡 Detection & Monitoring
Log Indicators:
- Unusual SIP dialog errors
- Process crashes or restarts
- High CPU usage from SIP processes
- Hash table collision warnings
Network Indicators:
- Abnormal SIP forking patterns
- Excessive SIP error responses
- Unusual dialog termination sequences
SIEM Query:
process.name:"asterisk" AND (log_message:"dialog collision" OR log_message:"hash table error" OR event.outcome:"failure")🔗 References
- http://packetstormsecurity.com/files/166226/Asterisk-Project-Security-Advisory-AST-2022-005.html
- http://seclists.org/fulldisclosure/2022/Mar/1
- https://github.com/pjsip/pjproject/commit/db3235953baa56d2fb0e276ca510fefca751643f
- https://github.com/pjsip/pjproject/security/advisories/GHSA-ffff-m5fm-qm62
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00040.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
- http://packetstormsecurity.com/files/166226/Asterisk-Project-Security-Advisory-AST-2022-005.html
- http://seclists.org/fulldisclosure/2022/Mar/1
- https://github.com/pjsip/pjproject/commit/db3235953baa56d2fb0e276ca510fefca751643f
- https://github.com/pjsip/pjproject/security/advisories/GHSA-ffff-m5fm-qm62
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00040.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
