CVE-2025-54995

Executive Summary

CVE-2025-54995 is a resource exhaustion vulnerability in Asterisk, an open-source PBX and telephony toolkit. The flaw allows an unauthenticated, remote attacker to cause a denial of service (DoS) by leaking RTP UDP ports and internal resources due to a lack of session termination. This can lead to resource exhaustion, making the system unavailable for legitimate calls. The vulnerability affects versions prior to 18.26.4 and 18.9-cert17. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. However, the potential impact on availability is high, and organizations running affected versions should prioritize patching.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required for exploitation.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is modified.
• Availability Impact: High (A:H) – Resource exhaustion can lead to a complete denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the lack of public exploits and low EPSS score reduce immediate risk. However, the ease of exploitation (no authentication, low complexity) makes it a significant threat for unpatched systems.

Deep Dive & Mechanics

The vulnerability lies in Asterisk's handling of RTP (Real-time Transport Protocol) sessions. When an RTP session is established (e.g., for a VoIP call), the system allocates UDP ports and internal resources to manage the media stream. The flaw occurs because the session termination logic is incomplete or missing under certain conditions. Specifically, if a session is not properly closed (e.g., due to a malformed SIP message, network interruption, or attacker-initiated partial handshake), the allocated resources are not released. Over time, repeated exploitation can exhaust all available RTP ports and internal memory, preventing new calls from being established.

The root cause is a missing or incorrect cleanup routine in the session management code. The fix in versions 18.26.4 and 18.9-cert17 ensures that all allocated resources are freed when a session ends, regardless of how it terminates.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the RTP session management module (e.g., res_rtp_asterisk.c). The exact diff is not publicly available, but the patch addresses the lack of session termination. A conceptual comparison:

Vulnerable Code (Pseudocode):

void handle_rtp_session(session_t *s) {
    // Allocate resources
    allocate_ports(s);
    allocate_buffers(s);
    // Process media
    while (session_active(s)) {
        process_media(s);
    }
    // Missing: cleanup on abnormal termination
    // free_ports(s);
    // free_buffers(s);
}

Patched Code (Pseudocode):

void handle_rtp_session(session_t *s) {
    allocate_ports(s);
    allocate_buffers(s);
    while (session_active(s)) {
        process_media(s);
    }
    // Proper cleanup
    free_ports(s);
    free_buffers(s);
    destroy_session(s);
}

The patched version ensures that free_ports() and free_buffers() are always called, even if the session terminates abnormally.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Asterisk < 18.26.4 or < 18.9-cert17.
• Network access to the SIP/RTP ports (typically UDP 5060 for SIP, UDP 10000-20000 for RTP).

Exploitation Steps:

1. Reconnaissance: Scan for Asterisk services using Shodan or Nmap.

   nmap -sU -p 5060 <target_ip>
   

2. Craft Malformed SIP Messages: Send SIP INVITE requests that initiate RTP sessions but never complete the handshake (e.g., omit the ACK or send a BYE without proper termination).

   from scapy.all import *
   # Craft a SIP INVITE
   sip_invite = IP(dst="<target_ip>")/UDP(sport=5060, dport=5060)/SIP(method="INVITE", uri="sip:100@<target_ip>")
   send(sip_invite)
   # Do not send ACK or BYE - session remains open
   

3. Repeat: Send multiple such requests to exhaust RTP ports.

   for i in {1..1000}; do python3 exploit.py; done
   

4. Verify DoS: Attempt a legitimate call to the target. If it fails, resource exhaustion is achieved.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team (Defensive)

Detection:

• Monitor for a high number of incomplete SIP sessions (e.g., INVITE without ACK).
• Track RTP port usage; a sudden spike in allocated ports indicates an attack.
• Use network monitoring tools to detect anomalous SIP traffic patterns.

Mitigation:

• Immediately apply the patch (upgrade to 18.26.4 or 18.9-cert17).
• Implement rate limiting on SIP INVITE messages.
• Configure firewalls to restrict RTP port ranges to known IPs.
• Enable logging and alerting for resource exhaustion events.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of SIP INVITE messages from a single source without corresponding ACK or BYE.
  • RTP ports (UDP 10000-20000) showing allocation without active media streams.
  • Unusual number of half-open SIP sessions in Asterisk logs.
• System IOCs:
  • Asterisk logs containing repeated "RTP port allocation failed" errors.
  • System resource exhaustion (CPU/memory) due to Asterisk process.
  • lsof showing many open UDP sockets in the RTP range.
• Log Examples:

  [ERROR] RTP: Unable to allocate port for call
  [WARNING] RTP: Port pool exhausted
  

Detection Engineering

YARA Rule

rule CVE_2025_54995_Asterisk_RTP_Leak {
    meta:
        description = "Detects Asterisk RTP resource exhaustion vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-54995"
    strings:
        $s1 = "RTP: Unable to allocate port" nocase
        $s2 = "RTP: Port pool exhausted" nocase
        $s3 = "session termination" nocase
    condition:
        any of them
}

Sigma Rule

title: Asterisk RTP Resource Exhaustion
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-54995
author: Valters IT
logsource:
    product: asterisk
    service: asterisk
detection:
    selection:
        - "RTP: Unable to allocate port"
        - "RTP: Port pool exhausted"
    condition: selection
falsepositives:
    - Legitimate high call volume
level: high

Suricata Rule

alert udp any any -> any 5060 (msg:"CVE-2025-54995 - Asterisk RTP Resource Exhaustion Attempt"; content:"INVITE"; depth:6; flow:to_server; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Asterisk to version 18.26.4 or 18.9-cert17 (or later).
2. Workaround: If patching is not possible, implement rate limiting on SIP INVITE messages using iptables or a SIP-aware firewall.

   iptables -A INPUT -p udp --dport 5060 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
   iptables -A INPUT -p udp --dport 5060 -j DROP
   

3. Monitoring: Enable detailed logging for RTP and SIP sessions. Monitor for port exhaustion alerts.
4. Network Segmentation: Isolate Asterisk servers in a DMZ and restrict RTP port ranges to trusted IPs.
5. Regular Audits: Periodically review Asterisk logs for unusual session patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert