Denial of Service in Kamailio IMS P-CSCF Registration

Executive Summary

This vulnerability in Kamailio versions 6.1.1 and earlier involves a double memory free issue in the IMS P-CSCF registration handling components. It allows a remote attacker to cause a denial of service by triggering abnormal state handling during IMS registration processing.

Useful 0 Not Useful 0

Detection Guidance

Monitor Kamailio logs for segmentation faults (SIGSEGV) during IMS registration processing, particularly in the REGISTER_reply/ipsec_create path. Check for netlink errors reported by IPSec cleanup functions and memory state mismatches. High-rate registration traffic for the same user equipment may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause Kamailio's P-CSCF component to crash with a segmentation fault, leading to service disruption. This occurs during high-rate IMS registration traffic for the same user equipment, where overlapping registration transactions trigger the crash.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service via IMS P-CSCF registration handling, leading to crashes in Kamailio's P-CSCF component. Such disruptions could impact availability of communication services, potentially violating compliance requirements for data processing and availability under standards like GDPR (availability principle) and HIPAA (accessibility and integrity of PHI).

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 91c5ca7 to add null checks in the ims_usrloc_pcscf module's free_security() function. Update to a version of Kamailio that includes this fix. Monitor and limit rapid, high-rate IMS registration traffic to prevent overlapping transactions.

Useful 0 Not Useful 0