EUVD-2024-54634
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Tags
Description
Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
Analysis
Network-based information disclosure vulnerability in RTP (Real-time Transport Protocol) packet decoding that occurs when the CSRC (Contributing Source) count header field is improperly validated, allowing an attacker to read sensitive memory contents. The vulnerability affects any system processing RTP streams with malformed headers and has a high CVSS score of 8.2 due to the combination of high confidentiality impact and network accessibility without authentication; no patch availability, KEV status, EPSS score, or active exploitation details are currently documented.
Technical Context
RTP (RFC 3550) is a widely-used protocol for real-time media transport over IP networks. The vulnerability exists in the RTP header parsing logic, specifically in how the CC (CSRC count) field—which indicates the number of contributing sources in the CSRC list—is processed. CWE-126 (Buffer Over-read) indicates the root cause: improper validation of the CC header field length allows reading beyond allocated buffer boundaries, leaking adjacent heap/stack memory. This affects any RTP decoder/library that fails to validate that the declared CSRC count matches actual available packet data before dereferencing the header structure. Vulnerable implementations likely include libavformat (FFmpeg), GStreamer RTP plugins, PJSIP, Kurento, and other multimedia frameworks that parse RTP headers without bounds checking on the CC field.
Affected Products
Without specific CPE data provided, the vulnerability likely affects: (1) FFmpeg libavformat RTP decoder (all versions prior to patch); (2) GStreamer RTP plugins; (3) PJSIP library; (4) Kurento media server; (5) Asterisk PBX; (6) Any custom or proprietary RTP implementation with improper header validation. Specific versions depend on when the fix was merged upstream. Organizations should check vendor security advisories for their specific RTP-capable software (VoIP clients, conferencing platforms, streaming servers, media gateways). This is likely a regression or legacy bug affecting long-supported product lines.
Remediation
Remediation requires: (1) Immediate action: Identify all systems processing RTP streams (VoIP servers, conferencing platforms, media gateways, video surveillance systems); (2) Patch/Update: Apply vendor security updates to RTP libraries and applications as they become available—check FFmpeg, GStreamer, PJSIP, Asterisk, Kurento project pages for CVE-2024-53019 patches; (3) Temporary mitigation: Implement network-level filtering to reject malformed RTP packets with invalid CSRC counts (if detection logic is available); restrict RTP traffic to trusted sources only; (4) Workaround: If patching is delayed, disable RTP decoding features or use hardware appliances with updated firmware; (5) Validation: After patching, test RTP functionality end-to-end to ensure no regression. Monitor vendor advisories (NIST NVD, vendor security pages) for patch release timelines.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today