CVE-2022-23608CWE-416

Use after free in PJSIP

High · published February 22, 2022

CVSS v3.1
8.1
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04022 · 90.5th percentile
Weakness
CWE-416 · Use After Free
Published
2022-02-22T00:00Z
EPSS history
Timeline
  • 22 FEB 00:00Z
    Use after free in PJSIP
    cvelistv5