PT-2025-10135 · Ring · Ring

Published 2025-03-07 · Updated 2025-03-07

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions ring versions (affected versions not specified)

Description The issue arises from the ring::aead::quic::HeaderProtectionKey::new mask() function, which may panic when overflow checking is enabled. An attacker can exploit this by sending a specially crafted packet in the QUIC protocol, potentially causing a panic in 1 out of every 2**32 packets sent and/or received. Additionally, on 64-bit targets, operations using ring::aead::{AES 128 GCM, AES 256 GCM} may panic when encrypting or decrypting large amounts of data, approximately 68,719,476,700 bytes, in a single chunk. However, protocols like TLS and SSH are not affected as they break down large data into smaller chunks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-4P46-PWFR-66X6

Affected Products

Ring

References · 9

• https://osv.dev/vulnerability/GHSA-4p46-pwfr-66x6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4432 · Security Note
• https://github.com/briansmith/ring/pull/2447 · Note
• https://github.com/briansmith/ring · Note
• https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38 · Note
• https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2350655 · Note
• https://access.redhat.com/security/cve/CVE-2025-4432 · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0009.html · Note