CVE-2025-12205: Kamailio Use-After-Free Vulnerability

CVE-2025-12205 Overview

CVE-2025-12205 is a use-after-free vulnerability in Kamailio 5.5, an open-source SIP (Session Initiation Protocol) server used for VoIP and real-time communications. The flaw resides in the sr_push_yy_state function of src/core/cfg.lex, part of the Configuration File Handler component. An attacker with local access and the ability to manipulate configuration files can trigger the memory corruption. Public exploit code exists, but exploitation depends on the attacker already possessing sufficient privileges to modify Kamailio configuration files. The vendor was contacted about this disclosure but did not respond. The vulnerability is tracked under [CWE-119] and [CWE-416].

Critical Impact
Local exploitation via crafted configuration files can trigger use-after-free memory corruption in the Kamailio SIP server, potentially affecting VoIP service availability and integrity.

Affected Products

Kamailio 5.5.0
Component: src/core/cfg.lex (Configuration File Handler)
Function: sr_push_yy_state

Discovery Timeline

2025-10-27 - CVE-2025-12205 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12205

Vulnerability Analysis

The vulnerability lives in Kamailio's configuration lexer, specifically in sr_push_yy_state inside src/core/cfg.lex. This function manages parser state during configuration file processing. Improper handling of freed memory allows a reference to persist after the underlying object has been released, satisfying the conditions for a use-after-free. Because the flaw affects the lexer state stack, malformed or crafted directives can produce memory reuse patterns that lead to undefined behavior during configuration parsing.

Exploitation requires local access to the host and write access to Kamailio configuration files. The public disclosure notes that this precondition limits realistic attack scenarios. Successful triggering can result in process crashes, and in some cases enable further memory corruption primitives depending on allocator behavior.

Root Cause

The root cause is improper lifetime management of parser state objects within sr_push_yy_state. A pointer to a freed lexer state is dereferenced or otherwise operated on after release, matching [CWE-416] Use After Free. The broader classification [CWE-119] applies because the improper reuse occurs within a memory buffer boundary context managed by the lexer.

Attack Vector

The attack vector is local. An attacker must place a crafted Kamailio configuration file on disk and cause the daemon to parse it. In a typical deployment this requires filesystem write access to the configuration directory or the ability to influence configuration reload operations. The vulnerability is not reachable from a remote SIP peer through the normal signaling path, which constrains its exposure to insider or post-compromise scenarios.

See the OpenWall OSS Security disclosure and VulDB entry #329875 for the public technical write-up.

Detection Methods for CVE-2025-12205

Indicators of Compromise

Unexpected modifications or new files under Kamailio configuration directories such as /etc/kamailio/ or paths referenced by kamailio.cfg.
Kamailio process crashes, segmentation faults, or abnormal restarts logged by systemd or the process supervisor during configuration load or reload.
Local user activity invoking kamailio -c or kamctl with non-standard configuration paths.

Detection Strategies

Monitor file integrity on Kamailio configuration files and alert on unauthorized modification.
Correlate configuration file changes with subsequent Kamailio service restarts or crash events.
Audit local shell activity on SIP servers for users invoking Kamailio binaries with attacker-controlled configuration paths.

Monitoring Recommendations

Enable core dump collection on Kamailio hosts and inspect crashes referencing sr_push_yy_state or cfg.lex.
Forward Kamailio stderr and syslog output to a centralized logging platform and alert on parser or lexer errors.
Track privileged access to VoIP infrastructure hosts and flag lateral movement leading to SIP servers.

How to Mitigate CVE-2025-12205

Immediate Actions Required

Restrict write permissions on Kamailio configuration files and directories to a minimal set of administrative accounts.
Enforce file integrity monitoring on kamailio.cfg and included configuration fragments.
Limit interactive local access to SIP server hosts and apply least-privilege principles for operations staff.
Review installed Kamailio versions and identify hosts running 5.5.0 for prioritized hardening.

Patch Information

At the time of publication, the vendor had not responded to the disclosure and no official fixed version is referenced in the NVD entry. Operators should track upstream Kamailio releases and the OpenWall OSS Security thread for a fix commit. Once an upstream patch is merged, upgrade all affected 5.5.x deployments and rebuild any distribution packages that ship the vulnerable lexer.

Workarounds

Deploy Kamailio configuration files as read-only for the runtime service account and restrict write access to a change-controlled deployment pipeline.
Run Kamailio under a dedicated unprivileged user with mandatory access control (SELinux or AppArmor) profiles limiting file write scope.
Disable automatic configuration reload paths that can be triggered by non-administrative users.
Isolate SIP servers on management networks that block interactive local access from general-purpose systems.

bash

# Configuration example: restrict Kamailio config file permissions
chown -R root:kamailio /etc/kamailio
chmod 750 /etc/kamailio
find /etc/kamailio -type f -exec chmod 640 {} \;

# Enable file integrity monitoring (auditd example)
auditctl -w /etc/kamailio/kamailio.cfg -p wa -k kamailio_cfg_change
auditctl -w /etc/kamailio/ -p wa -k kamailio_cfg_dir_change