CVE-2023-40018
📋 TL;DR
FreeSWITCH versions before 1.10.10 contain an out-of-bounds write vulnerability in ICE candidate handling. Remote attackers can trigger memory corruption by sending SDP offers with unknown component IDs, potentially causing crashes or undefined behavior. This affects all FreeSWITCH deployments using vulnerable versions.
💻 Affected Systems
- FreeSWITCH
📦 What is this software?
Freeswitch by Freeswitch
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this would require additional exploitation techniques beyond the initial memory corruption.
Likely Case
Service disruption through denial of service (crash) and potential information disclosure from memory corruption.
If Mitigated
No impact if patched or if network controls prevent malicious SDP offers.
🎯 Exploit Status
Exploitation requires sending a specially crafted SDP offer, which is straightforward for attackers familiar with SIP/WebRTC protocols.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.10
Vendor Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-7mwp-86fv-hcg3
Restart Required: Yes
Instructions:
1. Backup configuration files. 2. Stop FreeSWITCH service. 3. Upgrade to version 1.10.10 using package manager or compile from source. 4. Restart FreeSWITCH service. 5. Verify version with 'freeswitch -version'.
🔧 Temporary Workarounds
Network filtering for malicious SDP
allUse SIP firewalls or WAFs to filter SDP offers containing ICE candidates with unknown component IDs
Disable ICE support
allDisable ICE candidate processing in FreeSWITCH configuration if not required
<param name="disable-ice" value="true"/> in sip_profiles or other relevant configuration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FreeSWITCH from untrusted networks
- Deploy intrusion detection systems to monitor for malicious SDP patterns
🔍 How to Verify
Check if Vulnerable:
Check FreeSWITCH version with 'freeswitch -version' or 'fs_cli -x version'. If version is below 1.10.10, system is vulnerable.Check Version:
freeswitch -version 2>/dev/null | head -1 || fs_cli -x 'version' 2>/dev/null | grep 'FreeSWITCH'Verify Fix Applied:
After patching, verify version is 1.10.10 or higher with 'freeswitch -version'. Test ICE functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault crashes in logs
- Unexpected memory access errors
- Abnormal termination of FreeSWITCH processes
Network Indicators:
- SDP offers with unusual ICE candidate component IDs (not 1 or 2)
- Multiple failed ICE negotiation attempts from single source
SIEM Query:
source="freeswitch.log" AND ("segmentation fault" OR "SIGSEGV" OR "out of bounds")