CVE-2025-12205
📋 TL;DR
A use-after-free vulnerability in Kamailio's configuration file parser allows local attackers to potentially crash the service or execute arbitrary code by manipulating configuration files. This affects Kamailio 5.5 installations where attackers have local access to modify configuration files. The vulnerability requires local access and configuration file manipulation, which may limit practical exploitation.
💻 Affected Systems
- Kamailio SIP Server
📦 What is this software?
Kamailio by Kamailio
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise via arbitrary code execution as the Kamailio process user.
Likely Case
Service crash (denial of service) when malformed configuration files are processed during reload or restart.
If Mitigated
No impact if proper file permissions prevent unauthorized configuration file modifications.
🎯 Exploit Status
Exploit details are public but require local access and configuration file manipulation. Some security researchers doubt the practical exploitability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE - Vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to latest Kamailio version and monitor for security updates.
🔧 Temporary Workarounds
Restrict configuration file permissions
allEnsure only authorized users can modify Kamailio configuration files
chmod 640 /etc/kamailio/kamailio.cfg
chown root:kamailio /etc/kamailio/kamailio.cfg
Monitor configuration file changes
LinuxImplement file integrity monitoring for Kamailio configuration files
# Use auditd: auditctl -w /etc/kamailio/ -p wa -k kamailio_config
# Or use inotify/inotifywait tools
🧯 If You Can't Patch
- Implement strict access controls on Kamailio configuration directories
- Use configuration management tools with change approval workflows
🔍 How to Verify
Check if Vulnerable:
Check Kamailio version: kamailio -V | grep 'version:'Check Version:
kamailio -V | grep 'version:'Verify Fix Applied:
No official fix available. Verify workarounds by checking file permissions: ls -la /etc/kamailio/kamailio.cfg📡 Detection & Monitoring
Log Indicators:
- Kamailio crash logs
- Configuration parsing errors in syslog
- Unexpected service restarts
Network Indicators:
- Sudden loss of SIP service
- Failed SIP registrations
SIEM Query:
source="syslog" AND ("kamailio" AND ("segmentation fault" OR "crash" OR "config error"))🔗 References
- https://shimo.im/docs/ZzkLMVMLOzIRlpAQ/
- https://vuldb.com/?ctiid.329875
- https://vuldb.com/?id.329875
- https://vuldb.com/?submit.673225
- https://www.openwall.com/lists/oss-security/2025/11/02/3
- http://www.openwall.com/lists/oss-security/2025/10/27/12
- http://www.openwall.com/lists/oss-security/2025/10/27/8
- https://www.openwall.com/lists/oss-security/2025/10/27/8
