CVE-2026-31427

Vulnerability

Description

In the Linux kernel's netfilter connection tracking helper for SIP, the function process_sdp() declares a union nf_inet_addr rtp_addr on the stack and passes it to the sdp_session hook after iterating SDP media descriptions. However, rtp_addr is only assigned inside the media loop when a recognized media type with a non-zero port is encountered. If the SDP body lacks media lines (m=), contains only inactive media (e.g., m=audio 0...), or uses unrecognized media types, rtp_addr remains uninitialized. Despite this, the function still calls the hook with the uninitialized address, leading to a kernel stack information leak or corruption depending on compiler and kernel configuration [1][2][3][4].

Attack

Vector and Exploitation

An attacker can exploit this by sending a crafted SIP message containing an SDP body with no active media descriptions. The Linux kernel's netfilter module will process the SDP, and because rtp_addr is left uninitialized, the sdp_session hook receives a pointer to stack memory containing stale data. With CONFIG_INIT_STACK_ALL_ZERO (default on many distributions), this causes the session owner (o=) and connection (c=) addresses to be rewritten to 0.0.0.0. Without such initialization, the rewritten address is whatever random data was on the stack. The attack requires the system to process SIP traffic through netfilter, typically in a gateway or VoIP-aware firewall role, but no special privileges beyond network access are needed for the network-facing component [1].

Impact

A successful exploitation results in denial of service for SIP sessions: the session-level addresses are corrupted, causing legitimate SIP endpoints to receive malformed SDP data. This can disrupt VoIP call setup, registration, or media negotiation. The corruption is persistent for the duration of the conntrack entry, potentially affecting all subsequent SIP messages for that session. The CVSS v3 score of 5.5 (Medium) reflects the local network-based attack vector and the availability impact with no confidentiality or integrity loss, though the leak of stack memory could theoretically expose kernel information in non-zero-init configurations [1].

Mitigation

The fix pre-initializes rtp_addr from the session-level connection address (caddr) when available, tracks whether a valid address was established with a have_rtp_addr flag, and skips the sdp_session hook entirely when no valid address is present. Patches have been committed to the stable kernel trees as shown in the referenced commits [1][2][3][4]. System administrators should apply the latest stable kernel updates that include this fix; no workaround is available for unpatched kernels.