CVE-2022-31001: 
NixOS vulnerability analysis and mitigation

CVE-2022-31001 is a vulnerability discovered in Sofia-SIP, an open-source Session Initiation Protocol (SIP) User-Agent library, that was disclosed on May 31, 2022. The vulnerability affects versions prior to 1.13.8 and allows an attacker to send malicious SDP messages to FreeSWITCH, potentially causing system crashes (GitHub Advisory, NVD).

The vulnerability is caused by an out-of-bounds read issue in the sip_method_d function. The vulnerability stems from the MATCH macro definition #define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0), which can make 'n' larger than intended and trigger out-of-bounds access when IS_NON_WS(s[n]) is called (GitHub Advisory).

The exploitation of this vulnerability can lead to system crashes resulting in denial of service. In some cases, it could potentially lead to remote code execution (Gentoo Security, Debian LTS).

The vulnerability has been fixed in Sofia-SIP version 1.13.8. Users are strongly recommended to upgrade to this version or later. Various Linux distributions have also released security updates to address this vulnerability, including Ubuntu, Debian, and Gentoo (Ubuntu Security, Debian Security).