A memory safety flaw in the Kamailio IMS modules allows an unauthenticated remote attacker to trigger an out-of-bounds read, potentially leading to incorrect integer processing or service instability.

The vulnerability exists because the function get_4bytes in multiple IMS modules fails to verify that the length of a Diameter AVP is at least 4 bytes before reading the value. An attacker capable of sending a crafted Diameter message can trigger this read, which bypasses memory bounds checking and may result in the application processing incorrect data.

Successful exploitation of this vulnerability can cause the application to compute incorrect values, leading to logic errors in IMS Diameter transactions. While the CVSS score of 7.4 indicates a high severity, the primary risk involves service disruption or the degradation of security controls relying on these AVP values. Given that Kamailio is often used in critical telecommunications infrastructure, the potential for unauthorized manipulation of subscriber sessions or charging data poses a significant operational risk.

Immediate Action: Update Kamailio to a supported version that incorporates the fix provided in commit abb5d60af6eefbd367bf6588c5589566b090e272. Users on version 5.5.0 or older should note that these versions are unmaintained and require an immediate upgrade to a secure, supported release.

Proactive Monitoring: Review Diameter traffic logs for malformed AVP structures or unexpected transaction failures that may indicate an attempt to exploit this parsing flaw.

Compensating Controls: Deploy a Diameter-aware firewall or an Intrusion Prevention System capable of inspecting Diameter protocol traffic to drop packets containing improperly sized AVPs.

Public Exploit Available: Yes (a published proof of concept exists via the official Kamailio GitHub issue tracker).

The presence of a public proof of concept and the nature of the flaw in critical IMS modules necessitate immediate attention. Organizations should prioritize updating their Kamailio instances to patched versions. If an immediate upgrade is not feasible, implement strict input validation on Diameter traffic as a temporary defensive measure to prevent the processing of malformed AVP data.