Buffer overflow in libalias RTSP handler
FreeBSD-SA-26:41.libalias · CVE-2026-49420
Our decision for FreeSense
FreeBSD corrected this on 2026-06-30, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2026-06-30
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
Systems running natd(8) are vulnerable only so long as libalias_smedia.so is listed in /etc/libalias.conf. Removing it from that file and restarting natd(8) ensures that the vulnerable code is not loaded. Systems using ipfw(4) to implement NAT are affected only if the alias_smedia.ko kernel module is loaded. The affected code only runs on TCP or UDP packets undergoing outbound NAT translation, when the source port is 554 or 7070, or the destination port is 554 or 7070. Dropping such packets before they reach the NAT rule prevents the bug from being triggered.
What FreeBSD says
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet.
Impact
A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.