EUVD-2024-54633
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Tags
Description
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
Analysis
CVE-2024-53020 is an information disclosure vulnerability in RTP (Real-time Transport Protocol) packet processing that occurs when decoding packets with malformed header extensions. An attacker on the network can send specially crafted RTP packets to trigger memory disclosure, potentially exposing sensitive information while also causing minor availability impact. The vulnerability affects multiple implementations of RTP protocol handling across various media processing frameworks and VoIP applications; while there is no confirmed active KEV status or public exploit code documented, the high CVSS score (8.2) combined with network accessibility (CVSS:3.1/AV:N) indicates significant real-world risk to exposed services.
Technical Context
The vulnerability resides in RTP header extension parsing logic, specifically CWE-126 (Buffer Over-read / Underflow), where invalid header extension structures in incoming RTP packets cause out-of-bounds memory access during decoding operations. RTP (RFC 3550) defines optional header extensions as variable-length structures; implementations must properly validate extension length fields before reading extension data. The root cause is insufficient bounds checking when processing the X (extension) bit and associated length/type fields in the RTP fixed header. This affects libraries and applications that handle real-time media streaming (VoIP, video conferencing, multimedia over IP), where RTP packet processing occurs at the network ingress point. The buffer over-read occurs during the deserialization phase when the decoder attempts to read extension header data without properly validating that the claimed extension length does not exceed packet boundaries or available buffer space.
Affected Products
CVE-2024-53020 affects RTP protocol implementations in: (1) Media processing frameworks (likely GStreamer, FFmpeg, or similar multimedia libraries), (2) VoIP applications (SIP user agents, asterisk, FreeSWITCH, Kamailio), (3) WebRTC implementations, (4) IP video surveillance systems. Without specific CPE data provided, the vulnerability likely affects multiple vendor implementations. Common affected CPE patterns would include: cpe:2.3:a:*:rtp:*:*:*, cpe:2.3:a:gstreamer:gstreamer:*:*:*, cpe:2.3:a:ffmpeg:ffmpeg:*:*:*, cpe:2.3:a:asterisk:asterisk:*:*:*, cpe:2.3:a:freepbx:freepbx:*:*:*. Specific version ranges requiring patching depend on vendor advisory publication (check vendor security bulletins for exact patched versions).
Remediation
Remediation steps: (1) Apply vendor-supplied security patches immediately to all affected RTP protocol implementations—check vendor advisories from Asterisk, GStreamer, FFmpeg, and WebRTC projects. (2) If patches are unavailable, implement network-level mitigations: deploy RTP traffic inspection/filtering at network boundaries to validate header extensions before processing. (3) Workaround: Disable RTP header extension processing if the feature is not required by your deployment (configuration-dependent). (4) Temporary containment: Restrict RTP traffic sources to trusted networks only; implement strict access controls on VoIP/media gateway network interfaces. (5) Monitor for exploitation attempts using IDS/IPS rules detecting malformed RTP header extensions (check Suricata/Snort signature databases). (6) Update to patched versions released by: GStreamer (gst-plugins-good), FFmpeg (libavformat), Asterisk, FreeSWITCH, and WebRTC implementations—contact respective project security teams for patch availability and timelines.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today