Researchers from Faraday Security presented details at the DEFCON conference about the exploitation of a critical vulnerability (CVE-2022-27255) in the SDK for Realtek RTL819x chips, which allows executing custom code on the device by sending a specially crafted UDP packet. The vulnerability is noteworthy because it enables attacks on devices where access to the web interface is disabled for external networks — to execute the attack, it is sufficient to simply send one UDP packet.
The vulnerability affects devices that use vulnerable versions of the Realtek SDK, including eCos RSDK 1.5.7p1 and MSDK 4.9.4p1. Updates for eCos SDK to address the vulnerability were released by Realtek on March 25. It is still unclear which specific devices are affected — the Realtek RTL819x SoC is used in network routers, access points, Wi-Fi extenders, IP cameras, Internet of Things devices, and other network devices from over 60 manufacturers, including Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT-Link, Netgear, Smartlink, UPVEL, ZTE, and Zyxel.
Examples of exploits for gaining remote access to the device and executing commands have already been published in the public domain, including an attack example on the Nexxt Nebula 300 Plus router. Additionally, utilities for analyzing firmware for vulnerabilities have been made available.
Considering the issues with preparation and delivery, as well as firmware updates for already released devices, automated attacks and worms targeting vulnerable network devices are expected to emerge soon. Following a successful attack, affected devices may be used by attackers to form botnets, insert backdoors to leave a loophole within the enterprise's internal network, intercept transit traffic, or redirect it to an external host.
The vulnerability is caused by a buffer overflow in the 'SIP ALG' (SIP Application Layer Gateway) module, which is used for routing SIP packets through a network address translator. The issue arose due to a lack of validation of the actual size of the received data, leading to memory being overwritten beyond the fixed buffer when the strcpy function is called during SIP packet processing. An attack can be executed by sending a UDP packet with incorrect field values in the SDP data block or the SIP protocol header. To exploit the vulnerability, it is sufficient to send a single packet to any UDP port on the WAN interface.
As a workaround for protection, it is recommended to block UDP packets with SIP 'INVITE' messages, the line 'm=audio', and a size greater than 128 bytes at the firewall or in the intrusion prevention system. Here is an example rule for detecting exploitation attempts in IDS Snort 3: alert udp any any -> any any (sid:1000000; \ msg:"Realtek eCOS SDK SIP Traffic Exploit CVE-2022-27255"; \ content: "invite"; depth: 6; nocase; \ content: "m=audio "; \ isdataat: 128,relative; content:!"|0d|"; within: 128;)
Source: opennet.ru
