Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

Overview

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the Codec2 decoder caused by a floor/ceil sample-count mismatch. The codec_codec2 module must be loaded and Codec2 must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or source IP address matching, establish a call using Codec2, and send carefully crafted Codec2 audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected

• asterisk < 20.20.1
• asterisk >= 21.0.0-pre1, < 21.12.3
• asterisk >= 22.0.0-pre1, < 22.10.1
• asterisk >= 23.0.0-pre1, < 23.4.1
• certified-asterisk < 20.7-cert11
• certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.