Out-of-Bounds Read in Belledonne Communications bcg729

Belledonne Communications bcg729 versions up to 1.1.2 are susceptible to an out-of-bounds read vulnerability located in the decodeSIDframe() function within src/cng.c. The vulnerability is triggered by a network-adjacent attacker sending a specifically crafted, zero-length comfort-noise RTP payload. When processed, this payload causes an integer underflow in the filter order calculation. The resulting value wraps to 255 and is subsequently clamped to 10. Consequently, the function attempts to read 11 bytes from a buffer that contains zero bytes. This behavior leads to either the termination of the media processing component (Denial of Service) or the potential leakage of adjacent heap memory, which is then incorrectly interpreted as reflection coefficients. This vulnerability is significant for organizations deploying real-time communication infrastructure utilizing the bcg729 library.

Impact

Successful exploitation of this vulnerability results in the disruption of media processing services, causing a Denial of Service for affected voice/video communication applications. Additionally, the out-of-bounds read condition poses an information disclosure risk, as adjacent heap memory contents may be consumed and processed as valid media data.

Recommendation

• Upgrade the bcg729 library to the latest version, ensuring all dependencies are updated.
• Monitor network traffic for malformed RTP packets with zero-length payloads directed at telephony or media processing endpoints.
• Prioritize patching for systems acting as publicly reachable SIP or RTP gateways that utilize the affected library version.