CVE-2025-12207

Executive Summary

CVE-2025-12207 is a locally exploitable null pointer dereference vulnerability in Kamailio 5.5, specifically within the grammar rule handler (yyerror_at function in src/core/cfg.y). The vulnerability allows an attacker with local access to craft a malicious configuration file that triggers a null pointer dereference, leading to a denial of service (DoS) condition. The attack requires the ability to modify Kamailio configuration files, which is typically a privileged operation, reducing the practical attack surface. The vendor has not responded to disclosure, and no patch is currently available. The CVSS score is 3.3 (Low), reflecting the local attack vector and limited impact.

Supply Chain & Package Security

Kamailio is an open-source SIP server, typically distributed via source code or package managers (e.g., apt, yum). The vulnerability exists in the core configuration parser, which is part of the source code. Users are advised to verify the integrity of their Kamailio installation and configuration files. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs ability to modify config files.
• User Interaction (UI): None (N) – No user interaction needed.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – Service disruption possible.

Threat Level: Low. The attack is local and requires configuration file access, which is typically restricted to administrators.

Deep Dive & Mechanics

The vulnerability resides in the yyerror_at function within src/core/cfg.y, which is part of Kamailio's configuration file parser (grammar rule handler). When parsing a malformed configuration file, the function attempts to dereference a pointer that has not been properly initialized or has been set to NULL. This results in a null pointer dereference, causing the Kamailio process to crash (segmentation fault).

The specific trigger involves crafting a configuration file that causes the parser to enter an error state where yyerror_at is called with a NULL pointer argument. The function then attempts to use this pointer without validation, leading to the crash.

Root Cause: Lack of input validation on the pointer passed to yyerror_at during error handling in the grammar parser.

Vulnerable vs. Patched Code

Vulnerable Code (Kamailio 5.5 - src/core/cfg.y):

void yyerror_at(YYLTYPE *loc, const char *s) {
    // No check for loc being NULL
    fprintf(stderr, "%s:%d:%d: %s\n", loc->filename, loc->first_line, loc->first_column, s);
    // ...
}

Patched Code (Hypothetical fix):

void yyerror_at(YYLTYPE *loc, const char *s) {
    if (loc == NULL) {
        fprintf(stderr, "Error: %s\n", s);
        return;
    }
    fprintf(stderr, "%s:%d:%d: %s\n", loc->filename, loc->first_line, loc->first_column, s);
    // ...
}

The fix adds a NULL check before dereferencing the loc pointer.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Kamailio 5.5 server.
• Ability to modify the Kamailio configuration file (e.g., /etc/kamailio/kamailio.cfg).

Exploit Steps:

1. Create a malicious configuration file that triggers the null pointer dereference. For example, include a syntax error that causes the parser to call yyerror_at with a NULL location.
2. Replace the legitimate configuration file with the malicious one.
3. Restart the Kamailio service or trigger a configuration reload (e.g., kamctl reload).
4. The Kamailio process will crash due to the null pointer dereference.

Example Malicious Config Snippet:

# Trigger null pointer dereference
route {
    xlog("test");
    # Missing closing brace or invalid syntax

Note: The exact syntax to trigger the vulnerability may require reverse engineering of the parser. The above is a conceptual example.

Blue Team

Detection:

• Monitor for Kamailio crashes (segmentation faults) in system logs.
• Monitor for unexpected configuration file modifications.
• Use file integrity monitoring (FIM) on Kamailio configuration files.

Mitigation:

• Restrict write access to Kamailio configuration files to only trusted administrators.
• Implement configuration file validation before applying changes.
• Consider using a configuration management tool (e.g., Ansible, Puppet) to enforce configuration integrity.

Indicators of Compromise (IOCs)

• File: /etc/kamailio/kamailio.cfg (or custom config path) – Unexpected modifications.
• Log Entry: kernel: kamailio[PID]: segfault at IP ip_addr sp sp_addr error 6 in kamailio[base_addr+offset]
• Process: Kamailio process crash (core dump).
• Network: No specific network IOCs as this is a local attack.

Detection Engineering

YARA Rule

rule CVE_2025_12207_Kamailio_Null_Pointer_Deref {
    meta:
        description = "Detects Kamailio configuration files that may trigger CVE-2025-12207"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12207"
    strings:
        $s1 = "yyerror_at" nocase
        $s2 = "cfg.y" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Kamailio Null Pointer Dereference (CVE-2025-12207)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Kamailio crashes due to null pointer dereference in config parser
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "segfault"
        - "kamailio"
    condition: selection
falsepositives:
    - Other application crashes
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-12207 Kamailio Null Pointer Dereference Attempt"; flow:to_server; content:"kamailio"; nocase; content:"cfg"; nocase; sid:1000001; rev:1;)

Note: Suricata rule is generic as the attack is local and not network-detectable.

Remediation & Mitigation

Immediate Actions:

1. Restrict write access to Kamailio configuration files to only trusted administrators.
2. Implement file integrity monitoring (FIM) on configuration files.
3. Monitor system logs for Kamailio crashes.

Long-term Fix:

• Apply a patch from the vendor once available. Since the vendor has not responded, consider applying a manual fix by adding a NULL check in the yyerror_at function in the source code and recompiling Kamailio.

Workaround:

• Validate configuration files before applying them using a custom script that checks for syntax errors.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters-it.com.