CVE-2025-12205

Executive Summary

CVE-2025-12205 is a locally exploitable Use-After-Free (UAF) vulnerability in Kamailio 5.5, specifically within the configuration file parser (src/core/cfg.lex). The flaw resides in the sr_push_yy_state function, which is invoked when processing configuration directives. An attacker with local access and the ability to modify Kamailio’s configuration files can trigger a use-after-free condition, potentially leading to memory corruption, denial of service, or arbitrary code execution. The CVSS score is 5.3 (Medium), reflecting the requirement for local access and high privileges. The exploit is publicly available, but no official patch has been released by the vendor. The attack surface is limited to scenarios where an attacker can manipulate configuration files, which is often restricted to privileged users.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It affects the Kamailio SIP server source code, which is typically compiled from source or installed via distribution-specific packages. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Local – the attacker must have local access to the system.
• Attack Complexity (AC): Low – the exploit is straightforward once configuration file access is obtained.
• Privileges Required (PR): High – the attacker needs high privileges (e.g., root or kamailio user) to modify configuration files.
• User Interaction (UI): None – no user interaction required.
• Scope (S): Unchanged – the vulnerability does not affect other components.
• Confidentiality (C): Low – potential for limited information disclosure.
• Integrity (I): Low – potential for limited data modification.
• Availability (A): Low – potential for limited denial of service.

Threat Level: Medium. The requirement for local access and high privileges significantly reduces the attack surface. However, if an attacker already has such access, the vulnerability can be exploited to escalate privileges or cause instability.

Deep Dive & Mechanics

The vulnerability is a classic Use-After-Free (UAF) in the sr_push_yy_state function within src/core/cfg.lex. This function is part of the flex-generated lexer used to parse Kamailio’s configuration files. When the lexer processes certain malformed or specially crafted configuration directives, it may free a memory region (e.g., a state buffer) but continue to reference it later. This dangling pointer can then be dereferenced, leading to:

• Memory Corruption: Overwriting freed memory can corrupt heap metadata or other objects.
• Denial of Service: Accessing freed memory often causes a segmentation fault.
• Arbitrary Code Execution: If an attacker can control the freed memory contents, they may achieve code execution with the privileges of the Kamailio process (typically root or kamailio).

The attack requires the attacker to modify the configuration file (e.g., /etc/kamailio/kamailio.cfg) and then trigger a reload or restart of Kamailio. The specific trigger is a crafted configuration directive that causes sr_push_yy_state to free a state object while still holding a reference to it.

Vulnerable vs. Patched Code

Vulnerable Code (Kamailio 5.5, src/core/cfg.lex):

// Simplified representation of the vulnerable pattern
void sr_push_yy_state(yy_state_type new_state) {
    // ... allocate or reuse state
    if (some_condition) {
        free(state_buffer);  // Free the buffer
    }
    // ... later use of state_buffer without checking if it was freed
    state_buffer->field = value;  // Use-after-free
}

Patched Code (Hypothetical):

void sr_push_yy_state(yy_state_type new_state) {
    // ... allocate or reuse state
    if (some_condition) {
        free(state_buffer);
        state_buffer = NULL;  // Nullify the pointer after free
    }
    if (state_buffer != NULL) {  // Check before use
        state_buffer->field = value;
    }
}

No official patch exists. The fix would involve setting the pointer to NULL after freeing and adding a NULL check before dereferencing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Kamailio 5.5 server.
• Ability to modify the configuration file (e.g., as root or kamailio user).
• Knowledge of the vulnerable code path.

Exploitation Steps:

1. Craft Malicious Configuration: Create a configuration file that triggers the UAF. For example, a sequence of route blocks or modparam directives that cause the lexer to free and reuse state.
2. Replace Configuration: Overwrite /etc/kamailio/kamailio.cfg with the malicious file.
3. Trigger Reload: Send a SIGHUP to the Kamailio process or restart the service.
4. Observe Crash or Code Execution: The UAF may cause a crash (DoS) or, if memory is controlled, arbitrary code execution.

Example Exploit (Conceptual):

# Create a malicious config that triggers UAF
cat > /tmp/exploit.cfg << 'EOF'
#!KAMAILIO
# Malicious directives to trigger UAF
route {
    # ... crafted sequence
}
EOF

# Replace config and reload
cp /tmp/exploit.cfg /etc/kamailio/kamailio.cfg
kill -HUP $(pidof kamailio)

Blue Team (Defense)

Detection:

• Monitor for unexpected configuration file modifications.
• Use file integrity monitoring (e.g., AIDE, Tripwire) on /etc/kamailio/.
• Enable Kamailio’s debug logging to capture parser errors.

Mitigation:

• Restrict write access to configuration files to only the kamailio user.
• Use SELinux or AppArmor to confine the Kamailio process.
• Apply the hypothetical patch if source code access is available.

Indicators of Compromise (IOCs)

• File Modification: Unauthorized changes to /etc/kamailio/kamailio.cfg or other configuration files.
• Process Crash: Kamailio process crashes with a segmentation fault (SIGSEGV) during configuration reload.
• Log Entries: Kamailio logs showing parser errors or memory corruption warnings.
• Memory Dumps: Core dumps from Kamailio indicating heap corruption.

Detection Engineering

YARA Rule

rule CVE_2025_12205_Kamailio_UAF {
    meta:
        description = "Detects Kamailio 5.5 binary with vulnerable sr_push_yy_state function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12205"
    strings:
        $vuln_func = "sr_push_yy_state" ascii wide nocase
        $vuln_pattern = { 48 89 5c 24 ?? 48 89 6c 24 ?? 48 89 74 24 ?? 57 48 83 ec 20 } // Example bytes
    condition:
        $vuln_func and $vuln_pattern
}

Sigma Rule

title: Kamailio Configuration File Modification
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized modification of Kamailio configuration files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/etc/kamailio/'
        EventType: 'Write'
    condition: selection
falsepositives:
    - Legitimate administrator changes
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12205 Kamailio UAF Exploit Attempt"; flow:to_server; content:"kamailio"; nocase; pcre:"/sr_push_yy_state/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Mitigation:

   • Restrict write access to Kamailio configuration files to only the kamailio user.
   • Use file integrity monitoring to detect unauthorized changes.
   • Enable SELinux/AppArmor to confine the Kamailio process.

2. Long-Term Fix:

   • Apply the hypothetical patch (nullify pointer after free, add NULL check).
   • Upgrade to a patched version if the vendor releases one.
   • Consider using a different SIP server if no patch is forthcoming.

3. Workaround:

   • Avoid using dynamic configuration reloads; restart the service instead.
   • Validate configuration files before applying them.

Valters IT
DevSecOps & Cyber Threat Intelligence