CVE-2026-23457

Vulnerability

In the Linux kernel's netfilter connection tracking helper for SIP (nf_conntrack_sip), the function sip_help_tcp() parses the SIP Content-Length header using simple_strtoul(), which returns an unsigned long. However, the result is stored in a variable clen is declared as unsigned int. On 64-bit systems, this truncation silently discards high-order bits when the Content-Length value exceeds UINT_MAX. For example, a value of 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate the SIP message boundary [1][2].

Exploitation

An attacker can craft a SIP message with a Content-Length header containing a value larger than UINT_MAX. The truncated value causes the parser to treat the current message as shorter than it actually is. The remaining data in the TCP segment is then interpreted as a new SIP message and processed by the SDP parser. No authentication is required beyond the ability to send SIP traffic to a system using the SIP conntrack helper [1][2].

Impact

Successful exploitation allows an attacker to inject arbitrary SDP content into the connection tracking state. This can lead to manipulation of SIP session parameters, potentially enabling further attacks such as media redirection or denial of service or unauthorized call control. The vulnerability is rated High with a CVSS v3 score of 8.6 [1][2].

Mitigation

The fix changes clen to unsigned long to match the return type of simple_strtoul() and adds a check to reject Content-Length values that exceed the remaining TCP payload length. Patches have been applied to the Linux kernel stable branches as referenced in commits [1][2][3][4]. Users should update to the latest patched kernel version.