CVE-2024-3120: Irontec Sngrep Buffer Overflow Vulnerability

CVE-2024-3120 Overview

A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1, a popular command-line tool for visualizing SIP (Session Initiation Protocol) calls. The flaw is due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers in the sip_validate_packet and sip_parse_extra_headers functions within src/sip.c. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via crafted SIP messages.

Critical Impact

Remote attackers can achieve arbitrary code execution or crash the sngrep service by sending maliciously crafted SIP packets with oversized Content-Length or Warning headers, potentially compromising VoIP infrastructure monitoring systems.

Affected Products

• Irontec sngrep versions 1.4.1 and later (prior to v1.8.1)

Discovery Timeline

• 2024-04-10 - CVE-2024-3120 published to NVD
• 2025-02-03 - Last updated in NVD database

Technical Details for CVE-2024-3120

Vulnerability Analysis

This vulnerability represents a classic stack-buffer overflow condition within the SIP packet parsing functionality of sngrep. The vulnerable code paths exist in two critical functions: sip_validate_packet and sip_parse_extra_headers, both located in src/sip.c. When processing incoming SIP messages, these functions copy header values directly into fixed-size stack buffers without proper length validation.

The 'Content-Length' and 'Warning' SIP headers are particularly problematic because the code assumes these header values will fit within predefined buffer sizes. An attacker can craft SIP messages with excessively long header values that exceed these buffer boundaries, overwriting adjacent stack memory including return addresses and saved registers.

Root Cause

The root cause is inadequate bounds checking (CWE-120: Buffer Copy without Checking Size of Input) combined with out-of-bounds write operations (CWE-787: Out-of-bounds Write). The sip_validate_packet and sip_parse_extra_headers functions use fixed-size character arrays on the stack to store parsed header values. When copying header content from incoming SIP packets, the code fails to verify that the source data length does not exceed the destination buffer capacity, leading to stack corruption.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker positioned on the network can send specially crafted SIP packets to a host running sngrep. Since sngrep is typically used to capture and analyze SIP traffic, it will process any SIP messages visible on the monitored network interface.

The exploitation scenario involves:

1. Crafting a malicious SIP message with an oversized 'Content-Length' or 'Warning' header
2. Sending the packet to a network segment where sngrep is actively capturing traffic
3. When sngrep parses the malicious packet, the oversized header value overflows the stack buffer
4. Depending on the payload, this can result in arbitrary code execution or application crash

For technical details on the vulnerable code paths and the fix implementation, refer to the official patch commit.

Detection Methods for CVE-2024-3120

Indicators of Compromise

• Unexpected crashes or segmentation faults in the sngrep process
• Abnormally large SIP packets on the network with oversized Content-Length or Warning headers
• Core dumps from sngrep with stack corruption signatures
• Unusual process spawning or network connections originating from sngrep process

Detection Strategies

• Monitor for SIP packets with Content-Length or Warning header values exceeding typical sizes (e.g., >1024 bytes)
• Implement network IDS rules to detect malformed SIP messages with abnormally large headers
• Deploy runtime memory protection tools (ASAN, stack canaries) on systems running vulnerable sngrep versions
• Configure centralized logging to capture sngrep crash events and analyze for exploitation patterns

Monitoring Recommendations

• Enable core dump collection for sngrep processes to facilitate post-incident analysis
• Implement SIP traffic anomaly detection focusing on header length distributions
• Monitor system logs for repeated sngrep restarts which may indicate exploitation attempts
• Use endpoint detection and response (EDR) solutions to detect suspicious process behavior following sngrep execution

How to Mitigate CVE-2024-3120

Immediate Actions Required

• Upgrade sngrep to version 1.8.1 or later immediately
• If upgrade is not immediately possible, consider temporarily disabling sngrep on critical systems
• Implement network segmentation to limit exposure of systems running sngrep to untrusted network traffic
• Review firewall rules to restrict which hosts can send SIP traffic to monitored interfaces

Patch Information

The vulnerability has been addressed in sngrep version 1.8.1. The fix implements proper bounds checking when copying header values into stack buffers, ensuring that oversized input is truncated safely. The patch is available through the official GitHub release.

The specific commit addressing this vulnerability can be reviewed at the GitHub Pull Request.

Workarounds

• Deploy sngrep in isolated network segments with restricted access
• Use network filtering to drop SIP packets with abnormally large header values before they reach sngrep
• Run sngrep with reduced privileges and enable OS-level exploit mitigations (ASLR, stack protector, NX)
• Consider using containerization with restricted capabilities to limit the impact of potential exploitation

# Example: Running sngrep with reduced privileges in a container
docker run --cap-drop=ALL --cap-add=NET_RAW --read-only \
  --security-opt=no-new-privileges:true \
  sngrep:1.8.1 -c