CVE-2023-38703

PJSIP SRTP vulnerability, non-UDP transport, use-after-free

• CVSS 9.8
• CWE-416 Use After Free
• Memory Corruption
• Remote

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.

CVE

CVE-2023-38703

CWE

CWE-416 Use After Free

CVSS base score

9.8

Published

2023-10-06

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Use-After-Free Errors

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update PJSIP to the latest version with the patch applied.

class MediaTransport:
    def __init__(self):
        self.is_active = False

    def start(self):
        self.is_active = True

    def stop(self):
        self.is_active = False

class SRTP:
    def __init__(self, transport):
        self.transport = transport
        self.is_initialized = False

    def initialize(self):
        if self.transport.is_active:
            self.is_initialized = True

    def cleanup(self):
        if self.is_initialized:
            self.is_initialized = False
            pass

def main():
    transport = MediaTransport()
    transport.start()
    
    srtp = SRTP(transport)
    srtp.initialize()
    
    srtp.cleanup()
    
    if srtp.transport.is_active:
        print("Transport is still active, potential use-after-free!")

if __name__ == "__main__":
    main()

class MediaTransport:
    def __init__(self):
        self.is_active = False

    def start(self):
        self.is_active = True

    def stop(self):
        self.is_active = False

class SRTP:
    def __init__(self, transport):
        self.transport = transport
        self.is_initialized = False

    def initialize(self):
        if self.transport.is_active:
            self.is_initialized = True

    def cleanup(self):
        if self.is_initialized:
            self.is_initialized = False
            self.transport = None

def main():
    transport = MediaTransport()
    transport.start()
    
    srtp = SRTP(transport)
    srtp.initialize()
    
    srtp.cleanup()
    
    if srtp.transport is not None:
        print("Transport is still available, potential use-after-free!")
    else:
        print("Transport has been safely cleaned up.")

if __name__ == "__main__":
    main()

@misc{vaitp:cve202338703,
  title        = {{PJSIP SRTP vulnerability, non-UDP transport, use-after-free}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-38703},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-38703/}}
}