CVE-2023-38703

Executive Summary

CVE-2023-38703 is a use-after-free (UAF) vulnerability in the SRTP media transport layer of PJSIP, a widely deployed open-source multimedia communication library. The flaw arises from a synchronization gap between higher-level SRTP media transport and its underlying lower-level transport (e.g., ICE) when that lower transport is not UDP. Successful exploitation can lead to memory corruption, unexpected application termination, or control-flow hijacking, potentially enabling remote code execution in affected VoIP and video-conferencing applications. With a CVSS score of 9.8, the vulnerability is rated critical, and it affects any application built with PJMEDIA_HAS_SRTP enabled that uses non-UDP media transports. A patch exists as a commit in the PJSIP master branch but is only confirmed by a single source (Debian) as of this report.

Technical Analysis

PJSIP is a multimedia communication library written in C, providing high-level APIs for C, C++, Java, C#, and Python. It is used extensively in VoIP softphones, SIP servers, and embedded communication systems. The vulnerability resides in the media transport stack, specifically in the interaction between SRTP (Secure Real-time Transport Protocol) and lower-level transports.

The core issue is a concurrency and lifetime management flaw. SRTP operates as a higher-level media transport that is stacked on top of lower-level transports such as UDP or ICE (Interactive Connectivity Establishment). When applications use transports other than plain UDP (e.g., ICE), the higher-level transport (SRTP) is not synchronized with its lower-level transport. This lack of synchronization can result in a use-after-free condition, where memory associated with the lower-level transport is freed while the higher-level SRTP transport still holds references to it.

Mechanistically, in PJSIP's architecture, media transports are managed through a layered model. The SRTP transport wraps the underlying transport (e.g., ICE stream transport) and intercepts RTP packets for encryption/decryption. When the underlying transport is torn down or renegotiated (e.g., during ICE restart, network failure, or session re-invite), the memory for the lower transport object may be deallocated. However, if the SRTP layer does not receive a proper notification or callback before this deallocation occurs, it may subsequently access the freed memory, triggering undefined behavior.

The attack surface is significant because PJSIP handles untrusted network input by nature — it processes SIP signaling and RTP media streams. The use-after-free can be triggered remotely if an attacker can influence the media transport lifecycle, such as by initiating a session renegotiation (SIP re-INVITE), triggering an ICE restart, or causing a transport failure. The description does not specify the exact code path, function names, or API calls involved, and no additional technical details are available in the provided data. The impact is described as ranging from "unexpected application termination to control flow hijack/memory corruption," consistent with typical use-after-free exploitation.

The affected condition requires PJMEDIA_HAS_SRTP to be enabled at compile time, and the application must use a media transport other than plain UDP — ICE being the primary candidate. Applications using only plain UDP transports are not affected by this specific synchronization flaw.

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability, and no threat actor campaigns have been identified. The attack chain below is inferred from the vulnerability class (use-after-free) and the technical description provided.

1. Reconnaissance / Target Identification: An attacker identifies a target running a PJSIP-based VoIP or video-conferencing service. Public-facing SIP endpoints (port 5060) or RTP/ICE ports are discoverable via network scanning or Shodan-style queries. The attacker verifies the server's media capabilities (e.g., via SIP OPTIONS or session description negotiation) to confirm SRTP support and non-UDP transport (ICE) usage.

2. Triggering the Flaw: The attacker initiates a SIP session with the target, establishing an SRTP media stream over ICE. The attacker then manipulates the session's transport lifecycle — for example, by sending a re-INVITE that forces an ICE restart or triggers renegotiation of the media transport. During this renegotiation, the lower-level transport (ICE stream) is torn down and its memory freed, while the SRTP layer retains stale pointers.

3. Payload / Execution Method: At the vulnerability-class level, the attacker must craft the session renegotiation packets to race the transport teardown against the SRTP layer's cleanup routines. Successful exploitation of the use-after-free could allow the attacker to overwrite freed memory with controlled data (heap spraying) to redirect control flow (e.g., overwriting a function pointer) and achieve arbitrary code execution. The precise exploitation technique is unknown due to the lack of public technical detail.

4. Post-Exploitation Impact: Successful exploitation could yield full remote code execution with the privileges of the PJSIP application process. Depending on deployment, this could grant the attacker access to media content (call audio/video), credentials in memory, or pivoting opportunities into the broader network. Failure to achieve code execution would likely result in a denial-of-service condition via application crash.

Limitations: This attack chain is inferred from the vulnerability class and the NVD description. No public PoC exists, and the exact trigger conditions and exploitation primitives have not been disclosed. Insufficient technical detail is available to describe the precise memory corruption primitives.

Impact Assessment

The CVSS base score of 9.8 reflects critical severity: the attack vector is network-based (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and has no scope change (S:U), with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

• Business Impact: PJSIP is embedded in numerous commercial and open-source VoIP platforms, PBX systems, video conferencing solutions, and IoT communication devices. A remote code execution flaw in the media stack could allow attackers to compromise call infrastructure, intercept or manipulate communications, and disrupt availability. For organizations using PJSIP in mission-critical UCaaS or CPaaS products, this is a stand-to-critical risk.
• Affected Systems: Any application compiled with PJMEDIA_HAS_SRTP enabled and using non-UDP media transports (notably ICE). The absence of a stated version range in the CVE data suggests that all released versions up to the patch may be vulnerable. Debian has confirmed a patch in its packaging, but independent confirmation is lacking.
• Blast Radius: Given PJSIP's wide use in both server-side and client-side communications software, the blast radius is substantial. Compromise of a VoIP server could facilitate eavesdropping, call hijacking, fraud (toll fraud), and lateral movement into adjacent network segments.

Detection Guidance

Since no public exploit exists and the vulnerability is a memory-corruption flaw triggered via network renegotiation, detection is challenging. The following rules target anomalous SIP/session renegotiation behavior and crashes indicative of exploitation attempts.

Sigma Rule

title: Suspicious SIP Session Renegotiation Leading to PJSIP Crash
id: 2d8d6b98-9c4a-4f6c-8c0a-532d1e9e2f11
status: experimental
description: Detects rapid re-INVITE or session modification requests which may trigger use-after-free in PJSIP SRTP transport
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38703
author: Valters IT Threat Intel
date: 2025/03/12
logsource:
    product: application
    service: voip
detection:
    selection_renvite:
        sip.method: "INVITE"
        sip.header.count: 3  # multiple re-INVITEs in short window
    selection_ice:
        sip.body|contains: "ice-ufrag"
        sip.body|contains: "ice-pwd"
    timeframe: 5s
    condition: selection_renvite and selection_ice
level: high
falsepositives:
    - Legitimate call transfers or ICE restarts during network failover

YARA Rule

rule CVE_2023_38703_PJSIP_SRTP_UAF
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects malicious payload patterns targeting PJSIP SRTP use-after-free"
        cve = "CVE-2023-38703"
        date = "2025-03-12"
        severity = "critical"
    strings:
        $sip1 = "INVITE sip:" ascii
        $sip2 = "SDP" ascii
        $sdp_ice = "a=ice-ufrag" ascii
        $sdp_srtp = "a=crypto" ascii
        $hex_pattern = { 41 41 41 41 } // potential heap spray marker
    condition:
        uint16(0) == 0x0a0d and
        filesize < 20KB and
        ($sip1 or $sip2) and
        $sdp_ice and $sdp_srtp and
        #hex_pattern > 10
}

Suricata IDS Rule

alert sip any any -> any any (msg:"CVE-2023-38703 PJSIP SRTP Use-After-Free Attempt"; sid:10038703; rev:1; flow:to_server,established; content:"INVITE"; nocase; pcre:"/(?i)(a=ice-ufrag.*a=crypto)/"; threshold:type both, track by_src, count 5, seconds 10; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-38703; classtype:attempted-admin; metadata:created_at 2025_03_12, updated_at 2025_03_12;)

Elastic Detection

// Detect rapid SIP re-INVITE sequences with SDP changes
sequence by source.ip with maxspan=10s
    [network where dns.question.name : "*" and event.action : "network_traffic" and
     network.protocol : "sip" and
     process.name : "*pjsip*"]
    [network where network.protocol : "sip" and
     process.name : "*pjsip*" and
     network.bytes > 500 and
     network.bytes < 5000]
    | count by source.ip > 5

Splunk SPL Query

index=voip sourcetype=sip
| where method="INVITE"
| stats count as reinvite_count, dc(_time) as unique_times by src_ip, dest_ip
| where reinvite_count > 5 AND unique_times < 10
| eval risk_score = reinvite_count * 10
| search risk_score > 50
| table _time, src_ip, dest_ip, reinvite_count, risk_score
| rename src_ip as Attacker_IP, dest_ip as Target_Server

Wazuh OSSEC Rule

<group name="voip,">
    <rule id="100387" level="12">
        <decoded>SIP</decoded>
        <match>INVITE</match>
        <regex>a=ice-ufrag</regex>
        <description>CVE-2023-38703: Multiple SIP re-INVITEs with ICE/SRTP parameters - possible use-after-free exploitation</description>
        <options>no_full_log</options>
        <frequency>5</frequency>
        <timeframe>10</timeframe>
        <group>voip,exploit,attack</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (if patching is not immediately possible):

   • If feasible, disable SRTP support (PJMEDIA_HAS_SRTP=0) and require plain UDP for media transport, as the flaw only affects non-UDP transports.
   • Restrict SIP signaling access via firewall rules to trusted IPs/domains only; limit exposure of SIP endpoints to the public internet.
   • Deploy Web Application Firewall (WAF) or SIP-aware intrusion prevention systems to inspect and rate-limit re-INVITE requests.
   • Monitor for anomalous SIP traffic patterns (excessive re-INVITEs) and application crashes.

2. Patch / Upgrade Steps:

   • Apply the official patch from the PJSIP master branch. Since the CNA indicates the patch is a commit in the master branch, obtain the latest master or the next stable release that includes this commit.
   • For Debian-based systems, track the Debian security tracker for the official backported patch and upgrade the pjsip package when the update is published.
   • Independently verify the patch content before deployment; the patch claim is unconfirmed.

3. Long-Term Hardening:

   • Subscribe to PJSIP security advisories to receive timely notifications.
   • Conduct a code audit of any in-house customizations to PJSIP's SRTP/ICE integration.
   • Implement mandatory memory-safe practices: enable AddressSanitizer in test environments to catch UAF issues pre-deployment.
   • Network segmentation: isolate VoIP infrastructure from general IT systems to limit lateral movement in case of compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-38703
2. Debian Security Tracker (patch claim): https://security-tracker.debian.org/tracker/CVE-2023-38703
3. PJSIP Official Repository (patch commit in master branch): https://github.com/pjsip/pjproject (master branch)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2023-38703 NOT listed)

Threat Actor Campaigns / In-the-Wild Exploitation: No threat actor campaigns or exploitation in the wild have been publicly documented for this CVE as of this report's date. EPSS score of 0.01280 (67.3rd percentile) indicates a moderate probability of exploitation in the near term, but no active exploitation has been confirmed.