CVE-2025-12204
📋 TL;DR
A heap-based buffer overflow vulnerability exists in Kamailio's configuration file handler when processing malicious config files. This allows local attackers to potentially execute arbitrary code or crash the service. Only systems running vulnerable Kamailio versions with local access are affected.
💻 Affected Systems
- Kamailio SIP Server
📦 What is this software?
Kamailio by Kamailio
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise via arbitrary code execution.
Likely Case
Service crash (denial of service) or limited information disclosure from heap memory.
If Mitigated
No impact if proper file permissions prevent unauthorized config file modifications.
🎯 Exploit Status
Exploit details publicly disclosed but requires local access and config file manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
No official patch available; vendor did not respond to disclosure. Consider upgrading to latest Kamailio version and monitor for updates.
🔧 Temporary Workarounds
Restrict configuration file permissions
allSet strict file permissions on Kamailio configuration files to prevent unauthorized modifications
chmod 600 /etc/kamailio/kamailio.cfg
chown root:root /etc/kamailio/kamailio.cfg
Use configuration file integrity monitoring
LinuxMonitor configuration files for unauthorized changes using tools like AIDE or Tripwire
# Install and configure AIDE: apt-get install aide
# Initialize database: aideinit
# Check for changes: aide --check
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local users from modifying configuration files
- Monitor system logs for configuration file modification attempts and Kamailio crash events
🔍 How to Verify
Check if Vulnerable:
Check Kamailio version: kamailio -V | grep 'version' and verify if running version 5.5 or other potentially affected versionsCheck Version:
kamailio -V 2>&1 | grep -i versionVerify Fix Applied:
No official fix available; verify workarounds by checking configuration file permissions and monitoring for unauthorized changes📡 Detection & Monitoring
Log Indicators:
- Kamailio segmentation fault or crash logs
- Unauthorized configuration file modification events in system logs
- Unexpected Kamailio process termination
Network Indicators:
- Sudden loss of SIP service availability
- Unusual local file access patterns to Kamailio config files
SIEM Query:
source="kamailio.log" AND ("segmentation fault" OR "buffer overflow" OR "SIGSEGV") OR source="auth.log" AND "kamailio.cfg" AND ("modify" OR "change")🔗 References
- https://shimo.im/docs/loqeMWMyZGtpEYqn/
- https://vuldb.com/?ctiid.329874
- https://vuldb.com/?id.329874
- https://vuldb.com/?submit.673224
- https://www.openwall.com/lists/oss-security/2025/11/02/3
- http://www.openwall.com/lists/oss-security/2025/10/27/12
- http://www.openwall.com/lists/oss-security/2025/10/28/1
- https://www.openwall.com/lists/oss-security/2025/10/27/8
