| शीर्षक | meetecho janus webrtc server 1.4.2-videoroom Race Condition |
|---|
| विवरण | The VideoRoom plugin's join handler (src/plugins/janus_videoroom.c) with ptype=publisher checks max_publishers against the current publisher count, but does so WITHOUT proper mutex locking. Under concurrent join requests, multiple publishers can simultaneously pass the check before any of them is recorded in the room, resulting in a Time-Of-Check Time-Of-Use (TOCTOU) bypass. Verified on x.x.x.x:8088 (Janus 1.4.2, commit 4602fcc5) on 2026-08-14: created room 8888 with max_publishers=2; sent 8 concurrent join requests with ptype=publisher; result: 7 publishers joined successfully; listparticipants confirmed 48 publishers in room. This allows conference over-subscription (limit bypassed, leading to OOM/DoS), billing bypass, degraded QoS for other publishers. CWE-362: Concurrent Execution using Shared Resource without Proper Synchronization (TOCTOU Race Condition). CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H → 7.3 High. Fix: Wrap the check-and-increment sequence in a mutex lock (janus_mutex_lock). |
|---|
| स्रोत | ⚠️ https://github.com/meetecho/janus-gateway/blob/master/src/plugins/janus_videoroom.c |
|---|
| उपयोगकर्ता | qyf20051010 (UID 100545) |
|---|
| सबमिशन | 15/08/2026 03:59 PM (2 महीनों पहले) |
|---|
| संयम | 11/10/2026 01:26 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416606 [meetecho janus-gateway तक 1.4.2 VideoRoom janus_videoroom.c रेस कंडीशन] |
|---|
| अंक | 20 |
|---|