An unauthenticated client can drain the RTSP server’s packet pool with a couple of dozen requests<\/p>\n
that carry a Session header the parser cannot convert.<\/p>\n
The Session branch returns the raw NetX error code instead of an RTSP status code:<\/p>\n
“`c<\/p>\n
\/* addons\/rtsp\/nx_rtsp_server.c:2754 *\/<\/p>\n
status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id);<\/p>\n
if (status)<\/p>\n
{<\/p>\n
return(status); \/* NX_INVALID_PARAMETERS \/ NX_SIZE_ERROR \/ NX_OVERFLOW *\/<\/p>\n
}<\/p>\n
“`<\/p>\n
Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch<\/p>\n
eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The<\/p>\n
raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not<\/p>\n
recognise it, takes a path that returns without releasing the response packet it already allocated,<\/p>\n
and the block never goes back to the pool.<\/p>\n
Six requests with an empty Session header against a 22 packet pool:<\/p>\n
“`<\/p>\n
valid requests: after request 6: pool available = 21, AFTER = 22 \/ 22<\/p>\n
malformed requests: after request 6: pool available = 16, AFTER = 17 \/ 22<\/p>\n
“`<\/p>\n
One block per request, not returned when the client disconnects. Twenty six requests take the pool<\/p>\n
to zero and the server starts failing allocations, after which it serves nobody. If the pool is<\/p>\n
shared with the rest of the application, as it is in the shipped sample, the rest of the stack<\/p>\n
stops with it.<\/p>\n
Convert the `_nx_utility_string_to_uint` failure in the Session branch into<\/p>\n
NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on<\/p>\n
every exit path of `_nx_rtsp_server_error_response_send`.<\/p>\n","protected":false},"excerpt":{"rendered":"
An unauthenticated client can drain the RTSP server’s packet pool with a couple of dozen requests<\/p>\n
that carry a Session header the parser cannot convert.<\/p>\n
The Session branch returns the raw NetX e<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30700","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}