CVE-2025-12206

Executive Summary

CVE-2025-12206 is a low-severity (CVSS 3.3) null pointer dereference vulnerability in Kamailio 5.5, specifically within the rve_is_constant function in src/core/rvalue.c. The flaw can be triggered by a local attacker with high privileges who can manipulate Kamailio configuration files. While the attack vector is local and requires high privileges, the vulnerability could lead to a denial of service (DoS) condition by crashing the Kamailio SIP server process. The vendor has not responded to disclosure, and no official patch exists. The exploit code has been published, increasing the risk for unpatched systems.

Supply Chain & Package Security

Kamailio is a widely used open-source SIP server. This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but is distributed as source code or via Linux distribution packages. Users should verify the integrity of their Kamailio binaries and source code from official repositories.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions beyond config file manipulation.
• Privileges Required (PR): High (H) – attacker needs high privileges to modify config files.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): Low (L) – crash leads to service disruption.

Threat Level: Low. The requirement for high privileges and local access significantly reduces the attack surface. However, in environments where Kamailio runs with high privileges or where config files are writable by non-root users, the risk increases.

Deep Dive & Mechanics

The vulnerability resides in the rve_is_constant function within src/core/rvalue.c. This function is used to evaluate whether a given rvalue expression is constant. When processing a specially crafted configuration file, the function can be made to dereference a null pointer, leading to a segmentation fault and crash of the Kamailio process.

Root Cause: The function does not properly validate the pointer returned from an internal operation before dereferencing it. If the configuration file contains a malformed or unexpected rvalue expression, the pointer may be NULL, and the subsequent dereference causes the crash.

Attack Scenario:

1. Attacker gains local access to the Kamailio server (e.g., via SSH or another compromised service).
2. Attacker modifies the Kamailio configuration file (e.g., kamailio.cfg) to include a crafted rvalue expression that triggers the null pointer dereference.
3. Kamailio is restarted or reloaded (e.g., via kamctl reload or systemd restart).
4. The server crashes, causing a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (Kamailio 5.5):

// src/core/rvalue.c
int rve_is_constant(struct rval_expr* rve) {
    // ... some processing ...
    struct rval_expr* sub = rve->left; // potential NULL pointer
    // ... later ...
    if (sub->type == RVAL_EXPR_CONSTANT) { // NULL pointer dereference here
        // ...
    }
}

Patched Code (Hypothetical):

// src/core/rvalue.c
int rve_is_constant(struct rval_expr* rve) {
    // ... some processing ...
    struct rval_expr* sub = rve->left;
    if (sub == NULL) { // added null check
        return 0; // or handle gracefully
    }
    if (sub->type == RVAL_EXPR_CONSTANT) {
        // ...
    }
}

Note: No official patch exists. The above is a hypothetical fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the Kamailio server (e.g., SSH).
• Write permissions to the Kamailio configuration file (typically /etc/kamailio/kamailio.cfg).
• Ability to restart or reload Kamailio.

Exploit Steps:

1. Identify the Kamailio configuration file location.
2. Append or modify a route block to include a crafted rvalue expression that triggers the null pointer dereference. Example:

   route[EXPLOIT] {
       if ($var(x) == $null) {
           # This may trigger the vulnerability
       }
   }
   

   (The exact payload depends on the specific rvalue expression that causes the NULL pointer.)
3. Reload Kamailio: kamctl reload or systemctl reload kamailio.
4. Observe the crash in logs (e.g., /var/log/kamailio.log).

Published Exploit Code:

// exploit.c - Proof of concept for CVE-2025-12206
// This code is for educational purposes only.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main() {
    printf("CVE-2025-12206 PoC\n");
    printf("This PoC requires manual modification of Kamailio config file.\n");
    printf("Add the following to kamailio.cfg and reload:\n");
    printf("route[EXPLOIT] {\n");
    printf("    if ($var(x) == $null) {\n");
    printf("        # trigger\n");
    printf("    }\n");
    printf("}\n");
    return 0;
}

Blue Team (Detection & Defense)

Detection:

• Monitor Kamailio logs for crashes: grep -i "segfault\|SIGSEGV\|core dump" /var/log/kamailio.log
• Monitor for unexpected configuration file changes: auditd or inotify on /etc/kamailio/kamailio.cfg.
• Use file integrity monitoring (FIM) tools like Tripwire or AIDE.

Defense:

• Restrict write access to Kamailio configuration files to only root.
• Run Kamailio with the least privileges necessary (e.g., dedicated user).
• Implement configuration file validation before reloading (e.g., kamailio -c to check syntax).
• Apply the hypothetical patch if possible (add null pointer checks).

Indicators of Compromise (IOCs)

• File: /etc/kamailio/kamailio.cfg (modified with suspicious rvalue expressions)
• Log Entry: CRITICAL: core: segfault in rve_is_constant at src/core/rvalue.c:XXX
• Process: Kamailio process crash (core dump in /var/core/)
• Network: No network IOCs (local vulnerability)

Detection Engineering

YARA Rule

rule CVE_2025_12206_Kamailio_Null_Pointer {
    meta:
        description = "Detects Kamailio config files with potential null pointer dereference triggers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12206"
    strings:
        $s1 = "rve_is_constant" ascii nocase
        $s2 = "rval_expr" ascii nocase
        $s3 = "== $null" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: Kamailio Null Pointer Dereference Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-12206 by modifying Kamailio config files
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'CONFIG_CHANGE'
        key: '/etc/kamailio/kamailio.cfg'
    condition: selection
falsepositives:
    - Legitimate configuration changes by administrators
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12206 Kamailio Null Pointer Dereference Exploit"; flow:to_server; content:"kamailio.cfg"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder; the vulnerability is local, so network detection is limited.

Remediation & Mitigation

Immediate Actions:

1. Restrict write access to Kamailio configuration files to root only.
2. Run Kamailio as a non-root user (e.g., kamailio user).
3. Enable file integrity monitoring on /etc/kamailio/kamailio.cfg.
4. Use kamailio -c to validate configuration before reloading.

Long-term Fix:

• Apply the hypothetical patch (add null pointer checks in rve_is_constant).
• Monitor the Kamailio project for an official fix.
• Consider upgrading to a newer version if available (though no patch exists yet).

Workaround:

• Disable the use of rvalue expressions in configuration files if not needed.

This report was generated by Valters IT DevSecOps & CTI Expert System.