Summary

switch_stun_packet_parse() validates that each attribute's declared length fits in the remaining buffer, then dispatches by attribute type and casts attr->value to a type-specific structure (switch_stun_ip_t for address attributes, uint32_t for CHANGE_REQUEST / LIFETIME / BANDWIDTH / OPTIONS / NETWORK_INFO / ERROR_CODE). The cast and the byteswap that follows (ip->port = ntohs(ip->port), *u = htonl(*u)) read and write through the pointer without checking that the attribute payload is large enough for the cast type. A STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds memory access on the per-leg media buffer.

Impact

• Process crash on any ICE-enabled call leg that receives a crafted packet. The crash terminates the FreeSWITCH process, dropping every concurrent session.
• A single UDP datagram is sufficient; no retry, fragmentation, or session state from the attacker is required.
• The write primitive is constrained to the in-band ntohs / htonl byteswap of attacker-controlled bytes that happen to land at the OOB offset; remote code execution has not been demonstrated.

Affected configurations

Any deployment that negotiates ICE on a media leg. In practice that covers WebRTC profiles (mod_verto, Sofia wss/ws clients) and any Sofia profile where peers offer ICE. Non-ICE SIP/RTP legs are not in scope - the RTP read path only dispatches the datagram to the STUN parser after ICE credentials have been installed on the session.

Attack prerequisites

Network reach to the dynamically allocated UDP media port of an in-progress ICE-enabled call leg. STUN parsing runs before the STUN message integrity (HMAC) check, so the attacker needs neither the ICE password nor any prior interaction with the call; they only need to deliver a UDP datagram to the right port while the call is up. Port discovery is a routine UDP scan against the configured RTP port range.

Workarounds

No reliable in-process workaround - the parser runs unconditionally on any STUN-shaped datagram delivered to an ICE-enabled media socket. Operators who cannot upgrade should restrict the RTP port range to media peers reachable only over trusted transports (firewall, SBC in front, private interconnect). Disabling ICE is generally not viable: WebRTC requires it, and many SIP peers negotiate it by default.

Fix

Before each type-specific cast of attr->value, the parser now checks that the remaining buffer holds at least sizeof(switch_stun_ip_t) (for address attributes) or sizeof(uint32_t) (for the integer-valued attributes and ERROR_CODE). When the check fails the parser returns NULL, the caller logs Invalid STUN/ICE packet received and drops the datagram, and no dereference through the undersized attribute occurs.

Credit

zzoru(Jonghwan Kim) of LY Corporation