Asterisk — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Asterisk's conference bridge applications. Both use AST_LIST_TRAVERSE — a linear linked-list walk — in conference lookup and management operations. Measured at 1,000× and 2,000× respectively. Patches ready for upstream review.

The Defects

asterisk-0001 (PATCHED — HIGH): apps/app_meetme.c:948

/* find_conf() — called per conference lookup per incoming call: */
AST_LIST_TRAVERSE(&confs, cnf, list) {
    if (!strcmp(cnf->confno, confno)) {  /* O(C) scan per lookup */
        return cnf;
    }
}

AST_LIST_TRAVERSE walks the entire conference list linearly on every find_conf() call. During a burst of incoming calls: O(C²) total. Measured ratio: 1,000×.

asterisk-0002 (PATCHED — HIGH): app_confbridge.c

/* AST_LIST_TRAVERSE over active_list/waiting_list — per AMI kick/mute: */
AST_LIST_TRAVERSE(&conference->active_list, user, list) {
    /* O(P) scan per management operation */
}

Linear scan over conference participant lists on every AMI management operation (kick, mute, unmute). O(P × ops). Measured ratio: 2,000×.

Complexity Proof

asterisk-0001: For C=1000 concurrent conferences:

Per incoming call: O(C) list walk
Burst of C calls: O(C²) = 1,000,000 comparisons
Fixed: ast_hashtab conference registry → O(1) per lookup
1,000× measured ratio.

asterisk-0002: For P=2000 participants:

Per AMI operation: O(P) list walk
2,000× measured ratio.

Impact

All Asterisk deployments running MeetMe conferences (asterisk-0001) and ConfBridge-based conferences (asterisk-0002). Asterisk is the dominant open-source PBX platform used in enterprise telephony. Call centers, conference bridges, and enterprise PBX systems with many concurrent conferences hit asterisk-0001 on every incoming call. asterisk-0002 affects all ConfBridge deployments using AMI management.

The Fix

asterisk-0001: Replace AST_LIST_TRAVERSE scan with ast_hashtab:

/* Before */
AST_LIST_TRAVERSE(&confs, cnf, list) {
    if (!strcmp(cnf->confno, confno)) return cnf;
}

/* After */
/* CWE-407 fix: ast_hashtab for O(1) conference lookup instead of O(C) list walk. */
cnf = ast_hashtab_lookup(confs_hashtab, &lookup_conf);

asterisk-0002: Replace active_list/waiting_list with ast_hashtab indexed by channel name.

Patch

defects/asterisk/patch/asterisk-0001-0002-conf-hashtab.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your conference bridge test suite.
Assess CVE eligibility — both defects fire in real-time call handling paths.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.9 KiB Raw Blame History Unescape Escape