CVE-2022-24793

Executive Summary

CVE-2022-24793 is a heap buffer overflow vulnerability in PJSIP, a popular open-source multimedia communication library written in C. This issue affects PJSIP versions 2.12 and prior, specifically impacting applications that use built-in DNS resolution. The vulnerability exists in the parse_rr() function during DNS packet parsing and can be triggered by a malicious DNS response, leading to heap corruption that may result in denial of service or potential remote code execution. The flaw is related to CVE-2023-27585 (which affects parse_query()) but exists in a separate code path, making patching of both functions necessary.

Technical Analysis

PJSIP (PJProject) is a widely adopted multimedia communication library providing SIP, SDP, RTP, and DNS resolution capabilities. The vulnerability exists in the library's native DNS resolver, which parses DNS response packets received from configured DNS servers.

The core flaw lies in the parse_rr() function, which handles parsing of DNS resource records (RR) within response packets. A heap buffer overflow occurs when crafted DNS response packets contain malformed or maliciously constructed resource record fields. Because the affected code path dynamically allocates buffer space on the heap to store parsed record data, insufficient bounds checking during parse operations allows an attacker to write data beyond allocated memory boundaries.

This vulnerability is specifically identified as distinct from CVE-2023-27585, which targets the parse_query() function responsible for parsing DNS query records. Both functions parse untrusted network input from DNS servers, and both are exploitable through crafted DNS packets. The relationship between these vulnerabilities indicates that the DNS parser has multiple independent overflow points, suggesting systemic weakness in input validation within the DNS module.

The attack surface is limited to PJSIP applications that use the library's built-in DNS resolution. Applications configured to use an external resolver are not affected. The vulnerable code path requires the application to perform DNS queries and parse responses directly, making SIP clients, PBX systems, and other VoIP infrastructure using PJSIP with internal DNS resolution the primary targets.

Applications including the PJSIP client library need the application to contact DNS servers, either directly or through interception of legitimate DNS traffic. Since DNS traffic typically traverses the network unencrypted, an attacker positioned on the network path between the PJSIP application and its configured DNS server can inject crafted responses.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker identifies PJSIP-based applications by fingerprinting network services. SIP servers, softphones, and VoIP infrastructure exposing SIP signaling (typically UDP/TCP port 5060, or TLS port 5061) may be investigated for PJSIP usage. Shodan queries can identify exposed VoIP/SIP services. The attacker must also determine if the target uses PJSIP's built-in DNS resolver, which can be inferred from application configuration analysis or testing.

Step 2 — Flaw Trigger: The attacker must deliver a malicious DNS response to the target application. This can be achieved through several methods: (a) ARP spoofing or routing attacks to become man-in-the-middle between the target and legitimate DNS servers; (b) DNS cache poisoning to redirect the target to attacker-controlled DNS infrastructure; or (c) directly interacting with the application in a way that triggers DNS resolution of a domain under attacker control.

Step 3 — Payload Execution: The crafted DNS response contains a malicious resource record (RR) specifically engineered to exploit the buffer overflow in parse_rr(). When the PJSIP application processes this record, the insufficient bounds checking during heap allocation allows out-of-bounds writes. The attacker crafts the overflow payload to corrupt adjacent heap memory structures. With precise heap manipulation, this corruption can lead to memory disclosure, denial of service through application crash, or potentially arbitrary code execution depending on the compiler, platform, and memory layout.

Step 4 — Post-Exploitation Impact: Successful exploitation grants the attacker execution context of the PJSIP process. For a dedicated VoIP server, this could allow interception of calls, credential theft, configuration manipulation, or lateral movement within the network. Given the complexity of reliable heap exploitation, many attackers may settle for denial-of-service, which can disrupt voice communications infrastructure.

No public PoC is available at the time of writing, and the attack chain is inferred from the vulnerability class and patch details.

Impact Assessment

Confidentiality Impact: None (CVSS subscore: N) — the vulnerability does not directly allow data exfiltration, though memory corruption may lead to information disclosure in specific heap layouts.

Integrity Impact: None (CVSS subscore: N) — no integrity controls are directly bypassed.

Availability Impact: High (CVSS subscore: H) — the primary impact is denial of service through heap corruption, potentially causing application crashes or persistent instability requiring restarts.

CVSS Score: 7.5 (High severity) — Network-accessible, no authentication required, no user interaction required. The relatively high base score reflects the ease of network availability impact.

Business Blast Radius: For organizations operating VoIP infrastructure — including call centers, PBX systems, and unified communications platforms — exploitation of this vulnerability could disrupt voice services, degrade call quality through DNS-related failures, and require emergency maintenance. Support systems dependent on VoIP services could experience extended downtime. The library's popularity in embedded and mobile applications extends the blast radius to IoT and edge devices that incorporate PJSIP. Affected environments relying on PJSIP DNS resolution for SRV record lookups (critical for SIP routing) are particularly exposed — exploitation or even accidental triggering via malformed DNS responses could bring down core telephony services.

EPSS Score: 0.02160 (80.6% percentile) — While exploitation attempts are not yet widespread, the EPSS percentile indicates this vulnerability ranks more likely to be exploited than 80% of known CVEs, and the likely exploitation should be prioritized despite no active campaigns identified.

Detection Guidance

Sigma Rule

title: PJSIP DNS Parser Heap Buffer Overflow Attempt
id: 3f8f3b3b-1234-4a5f-8e1b-2c3d4e5f6a7b
status: experimental
description: Detects network traffic patterns consistent with crafted DNS responses targeting PJSIP parse_rr() heap buffer overflow
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
  category: dns
  product: dns
detection:
  selection_dns_response:
    dns.flags.response: "1"
    dns.count.answers: "0"
  selection_anomaly:
    - dns.qname|contains: ".invalid"
    - dns.qname|contains: ".test"
    - dns.qname|length: ">253"
  condition: selection_dns_response and selection_anomaly
  timeframe: 5m
level: high

YARA Rule

rule PJSIP_HeapOverflow_DNS_Parse {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects potential malicious DNS packet data targeting PJSIP parse_rr()"
        cve = "CVE-2022-24793"
        date = "2024-01-15"
    strings:
        $dns_signature = { 00 0C 00 01 00 01 C0 0C }  // Standard DNS RR header with compression pointer
        $sip_a = "sip" ascii
        $srv_a = "srv" ascii
        $excessive_rr = { (?: 00 00 00 00 | FF FF FF FF ) }
    condition:
        ($dns_signature at 0..4096) and
        (($sip_a or $srv_a) or ($excessive_rr)) and
        filesize < 8192
}

Suricata IDS Rule

alert dns any any -> any any (msg:"PJSIP DNS parse_rr() Heap Overflow Attempt (CVE-2022-24793)"; sid:20224793; rev:1; metadata:attack_target_server, created_at_2024_01_15, cve CVE_2022_24793, deployment Perimeter, signature_severity Major, tag DoS; dns.query; content:"|00 00 00 00|"; dns.type; content:"TXT"; dns.rdata; content:"|FF FF FF FF|"; threshold:type both, track by_dst, count 5, seconds 60; reference:cve,2022-24793; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-24793; classtype:attempted-dos; priority:1;)

Elastic Detection

sequence by source.ip, destination.ip
  [network where dns.question.type == "TXT" and dns.question.name : "*"]
  [network where dns.answers_count == 0 and dns.response_code == "NOERROR"]
  [network where dns.flags == "response" and dns.resolved_ip : "0.0.0.0"]
  [network where dns.answers_count > 30]

Splunk SPL Query

index=dns sourcetype=dns
| where dns_flags="response"
| eval answer_count = coalesce(dns_answers_count, 0)
| where answer_count > 20 OR dns_response_code="NOERROR" AND answer_count=0
| stats count by src_ip, dest_ip, dns_qname
| where count > 5
| table _time, src_ip, dest_ip, dns_qname, count
| sort - _time

Wazuh OSSEC Rule

<group name="pjsip,dns,">
  <rule id="100247" level="12">
    <decoded_as>json</decoded_as>
    <field name="dns.type">response</field>
    <field name="dns.answers">0</field>
    <field name="dns.response_code">NOERROR</field>
    <description>PJSIP DNS response anomaly - possible heap overflow attempt targeting CVE-2022-24793</description>
    <group>pjsip_dns_anomaly</group>
  </rule>
  <rule id="100248" level="14">
    <decoded_as>json</decoded_as>
    <field name="dns.answers_count">+30</field>
    <description>Excessive DNS answer count - possible PJSIP heap overflow attempt</description>
    <group>pjsip_dns_anomaly</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY — 2 independent sources confirm fix

1) Immediate Mitigations:

• Set nameserver_count to zero (0) in PJSIP configuration to disable the built-in DNS resolver immediately — this eliminates the vulnerable code path entirely.
• Configure PJSIP applications to use an external DNS resolver via system libraries or a separate DNS daemon (e.g., c-ares, systemd-resolved, Unbound).
• Segment DNS traffic: ensure that DNS queries and responses traverse network segments where traffic monitoring and filtering are in place.
• Deploy firewall rules restricting DNS traffic to trusted DNS server IP addresses only.

2) Patch/Upgrade Steps:

• Update PJSIP/pjproject to a version containing the fix in the master branch of the pjsip/pjproject GitHub repository. The fix addresses the overflow in parse_rr() and should be applied before trusting the library again.
• Verify that the patched version also addresses CVE-2023-27585, as the two vulnerabilities share the same DNS parsing code paths but affect different functions — both patches are required for full coverage.
• After patching, conduct regression testing of DNS resolution functionality, particularly SIP SRV lookups and NAPTR records, to confirm parsing correctness.

3) Long-Term Hardening:

• If DNS resolution is not a critical requirement for the application, keep the resolver disabled permanently.
• If DNS resolution is required, standardize on the external resolver pattern rather than the built-in PJSIP DNS module.
• Deploy DNS response validation and network-level DNS anomaly detection.
• Monitor PJSIP advisory channels (pjsip.org, GitHub pjsip/pjproject repository) for related vulnerabilities. The presence of multiple related CVEs (CVE-2022-24793 and CVE-2023-27585) suggests the DNS parser merits additional security review.
• Use memory-safe language wrappers or sandboxing (e.g., seccomp, containers) when deploying PJSIP-based services.

References

1. NVD Entry: CVE-2022-24793 — National Vulnerability Database listing with official description and references.
2. NVD Entry: CVE-2023-27585 — Related vulnerability in the same DNS parsing code path (parse_query() function), referenced for context.
3. PJSIP Official Website: pjsip.org — Project home page with release notes and security advisories.
4. GitHub Repository: pjsip/pjproject — Source code repository containing the patch in the master branch.
5. Debian Security Tracker: CVE-2022-24793 — Debian packaging status confirming the fix availability.

Threat Actor Campaigns: No known malicious campaigns associated with this specific CVE have been identified as of this report. CISA KEV status confirms this vulnerability is not listed as Known Exploited. However, the EPSS score (80.6% percentile) and the ease of delivering DNS-based attacks make proactive patching recommended. Related DNS parser vulnerabilities have been actively targeted in VoIP infrastructure attacks; treating this as a high-priority patch for exposed services is prudent.