CVE-2023-27601: Insufficient Information (NVD-CWE-noinfo)
value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`):

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-03-15T22:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: modules/sipmsgops/codecs.c
Commit date: 2021-11-11 15:33:30 +0200
Commit message: [sipmsgops] fix codec_delete_XX() parsing

Issue discovered during OpenSIPS Security Audit 2021,
        by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h

Diff: diff --git a/modules/sipmsgops/codecs.c b/modules/sipmsgops/codecs.c
index 2a8989051..fce3e4c5c 100644
--- a/modules/sipmsgops/codecs.c
+++ b/modules/sipmsgops/codecs.c
@@ -345,25 +345,28 @@ static int do_for_all_streams(struct sip_msg* msg, str* str1,str * str2,
 
 	return rez;
 }
 
 
-int delete_sdp_line( struct sip_msg * msg, char * s)
+/* deletes a SDP line (from a stream) by giving a pointer within the line.
+ * The stream is used to safeguard the identification of the line boundries.
+ */
+int delete_sdp_line( struct sip_msg * msg, char * s, struct sdp_stream_cell *stream)
 {
 	char * start,*end;
 
 	if( !s )
 		return 1;
 
 	start = s;
 	end  = s;
 
-	while(*start != '\n')
+	while(*start != '\n' && start > stream->body.s)
 		start--;
 	start++;
 
-	while(*end != '\n')
+	while(*end != '\n' && end < (stream->body.s+stream->body.len) )
 		end++;
 	end++;
 
 	/* delete the entry */
 	if( del_lump(msg, start - msg->buf, end - start,0) == NULL )
@@ -528,18 +531,18 @@ static int stream_process(struct sip_msg * msg, struct sdp_stream_cell *cell,
 
 				if( op == DELETE && !is_static )
 				{
 					/* find the full 'a=...' entry */
 
-					if( delete_sdp_line( msg, payload->rtp_enc.s) < 0 )
+					if( delete_sdp_line( msg, payload->rtp_enc.s, cell) < 0 )
 					{
 						LM_ERR("Unable to add delete lump for a=\n");
 						ret = -1;
 						goto end;
 					}
 
-					if( delete_sdp_line( msg, payload->fmtp_string.s) < 0 )
+					if( delete_sdp_line( msg, payload->fmtp_string.s, cell) < 0 )
 					{
 						LM_ERR("Unable to add delete lump for a=\n");
 						ret = -1;
 						goto end;
 					}

Vulnerable code: int delete_sdp_line( struct sip_msg * msg, char * s)
	while(*start != '\n')
	while(*end != '\n')
					if( delete_sdp_line( msg, payload->rtp_enc.s) < 0 )
					if( delete_sdp_line( msg, payload->fmtp_string.s) < 0 )
Fixed code: /* deletes a SDP line (from a stream) by giving a pointer within the line.
 * The stream is used to safeguard the identification of the line boundries.
 */
int delete_sdp_line( struct sip_msg * msg, char * s, struct sdp_stream_cell *stream)
	while(*start != '\n' && start > stream->body.s)
	while(*end != '\n' && end < (stream->body.s+stream->body.len) )
					if( delete_sdp_line( msg, payload->rtp_enc.s, cell) < 0 )
					if( delete_sdp_line( msg, payload->fmtp_string.s, cell) < 0 )