A critical heap-based buffer overflow in the Kamailio CDP Diameter Receiver allows remote, unauthenticated attackers to cause memory corruption and potential service disruption.

The vulnerability exists in the shm_malloc function within the CDP Diameter Receiver (src/modules/cdp/receiver.c). An unauthenticated attacker can send a specially crafted Diameter packet with a declared length shorter than the minimum header size, triggering a heap buffer overflow during the memory copy process.

Successful exploitation allows an unauthenticated remote attacker to corrupt heap memory, which can lead to immediate application crashes (Denial of Service) or potential remote code execution. Given the critical nature of Kamailio in telecommunications infrastructure, this vulnerability poses a severe risk to service availability and system integrity. The CVSS score of 8.3 reflects the high potential for impact and the ease of reachability for remote attackers.

Immediate Action: Upgrade to Kamailio version 6.0.8 or later, which incorporates the necessary bounds checking to prevent the overflow.

Proactive Monitoring: Monitor system logs for frequent process crashes, segmentation faults, or unexpected restarts of the Kamailio Diameter receiver processes.

Compensating Controls: Implement strict network access control lists to restrict traffic to Diameter interfaces (e.g., Cx, Rx, Gx ports) to only known and trusted peer IP addresses.

Public Exploit Available: Yes, a technical write-up containing reproduction steps and proof-of-concept logic is available via the official Kamailio GitHub issue tracker (Issue #4876).

The presence of a public technical write-up detailing the overflow mechanism significantly lowers the barrier for exploitation. Organizations utilizing Kamailio for Diameter signaling must prioritize upgrading to version 6.0.8 immediately. If an immediate upgrade is not feasible, restrict network access to Diameter interfaces to mitigate the risk of remote exploitation by unauthorized parties.