CVE-2021-24043: WhatsApp Buffer Overflow Vulnerability

CVE-2021-24043 Overview

CVE-2021-24043 is an out-of-bounds read vulnerability affecting multiple WhatsApp products across Android, iOS, and Desktop platforms. The flaw exists in the RTCP (Real-Time Transport Control Protocol) flag parsing code, where a missing boundary check allows attackers to trigger an out-of-bounds heap read. This vulnerability can be exploited when a user sends a malformed RTCP packet during an established call, potentially leading to information disclosure or application crashes.

Critical Impact

Attackers can exploit this vulnerability during active WhatsApp calls to read sensitive heap memory contents or cause denial of service by triggering application crashes through malformed RTCP packets.

Affected Products

• WhatsApp for Android prior to v2.21.23.2
• WhatsApp Business for Android prior to v2.21.23.2
• WhatsApp for iOS prior to v2.21.230.6
• WhatsApp Business for iOS prior to v2.21.230.7
• WhatsApp Desktop prior to v2.2145.0

Discovery Timeline

• 2022-02-02 - CVE-2021-24043 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-24043

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when software reads data past the end or before the beginning of an intended buffer. In the context of WhatsApp's RTCP implementation, the parsing code fails to properly validate the boundaries of flag fields within RTCP packets before accessing memory locations based on those values.

The attack can be executed over the network without requiring authentication or user interaction beyond having an established call with the victim. Successful exploitation could allow an attacker to read arbitrary heap memory contents, potentially exposing sensitive information such as cryptographic keys, session tokens, or other user data stored in memory. Additionally, attempting to read from invalid memory addresses can cause the application to crash, resulting in denial of service.

Root Cause

The root cause of CVE-2021-24043 lies in the RTCP packet parsing routine within WhatsApp's real-time communication stack. When processing incoming RTCP packets during voice or video calls, the application parses various flag fields to determine packet structure and payload handling. The vulnerable code fails to implement proper boundary validation before using flag values to calculate memory offsets for heap reads.

Specifically, the missing bounds check allows an attacker to craft RTCP packets with malicious flag values that cause the parser to read beyond the allocated buffer boundaries. This represents a fundamental input validation failure in the packet processing logic.

Attack Vector

The attack requires an established call between the attacker and victim. During the call, the attacker can send specially crafted RTCP packets containing malformed flag values. Since RTCP is a control protocol used alongside RTP (Real-Time Protocol) for managing media streams, these packets are processed as part of normal call signaling.

The vulnerability can be exploited by manipulating the flag fields within RTCP packets to contain values that, when used by the parsing code, result in memory access operations outside the intended buffer. This could be achieved by setting flag values that cause oversized offset calculations, leading the application to read heap memory beyond the packet buffer.

Due to the network-based attack vector and the lack of required authentication or user interaction during exploitation, this vulnerability poses a significant risk to WhatsApp users engaging in voice or video calls.

Detection Methods for CVE-2021-24043

Indicators of Compromise

• Unexpected WhatsApp application crashes during active voice or video calls
• Abnormal RTCP packet patterns with malformed flag values in network traffic
• Memory access violations or segmentation faults in WhatsApp process logs
• Unusual network traffic patterns during WhatsApp calls indicating crafted packets

Detection Strategies

• Implement network-level monitoring for anomalous RTCP packet structures during WhatsApp calls
• Monitor application crash logs for patterns consistent with out-of-bounds memory access
• Deploy endpoint detection solutions capable of identifying memory corruption attempts
• Analyze network traffic for RTCP packets with irregular or oversized flag field values

Monitoring Recommendations

• Enable verbose logging on endpoints to capture application crash details
• Implement network intrusion detection rules for malformed RTCP traffic
• Monitor for repeated connection attempts or call establishment patterns that may indicate exploitation attempts
• Use SentinelOne's behavioral AI to detect anomalous memory access patterns in communication applications

How to Mitigate CVE-2021-24043

Immediate Actions Required

• Update WhatsApp for Android to version 2.21.23.2 or later
• Update WhatsApp Business for Android to version 2.21.23.2 or later
• Update WhatsApp for iOS to version 2.21.230.6 or later
• Update WhatsApp Business for iOS to version 2.21.230.7 or later
• Update WhatsApp Desktop to version 2.2145.0 or later

Patch Information

WhatsApp has released patched versions for all affected platforms that address the missing boundary check in RTCP flag parsing. The fix implements proper validation of flag field values before using them in memory offset calculations, preventing out-of-bounds heap reads.

For detailed information about the security patches, refer to the WhatsApp Security Advisory 2021 and WhatsApp Security Advisory 2022.

Workarounds

• Limit voice and video calls to trusted contacts until patching is complete
• Use alternative communication platforms temporarily if immediate patching is not possible
• Implement network-level filtering to inspect and block malformed RTCP packets if enterprise infrastructure allows
• Monitor for and promptly apply automatic application updates on all devices

# Verify WhatsApp version on Android/iOS
# Navigate to Settings > Help > App Info to confirm version number
# Ensure automatic updates are enabled in device app store settings

# For enterprise MDM environments, enforce minimum version requirements:
# Android: v2.21.23.2
# iOS: v2.21.230.6
# Desktop: v2.2145.0