PT-2025-5595 · Unknown+6 · Rust-Openssl+6
Mmastrac
·
Publicado
2025-02-02
·
Atualizado
2025-11-26
·
CVE-2025-24898
CVSS v4.0
6.3
Média
| Vetor | AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
rust-openssl versions prior to 0.10.70
Description
The issue arises when
ssl::select next proto returns a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. If the server buffer's lifetime is shorter than the client buffer's, this can cause a use after free, potentially leading to the server crashing or returning arbitrary memory contents to the client. The function ssl::select next proto is typically used in the callback passed to SslContextBuilder::set alpn select callback. Code is only affected if the server buffer is constructed within the callback.Recommendations
To resolve the issue, update to version 0.10.70 or later of the
openssl crate, which fixes the signature of ssl::select next proto to properly constrain the output buffer's lifetime to that of both input buffers.
For versions prior to 0.10.70, ensure that the server buffer outlives the handshake or has a static lifetime to avoid the use after free issue.Exploit
Correção
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Debian
Linuxmint
Red Hat
Rocky Linux
Ubuntu
Rust-Openssl