rust openssl ssl::select_next_proto use after free
概要
rust openssl ssl::select_next_proto use after free
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::select_next_proto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the sever buffer's lifetime is shorter than the client buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crateopenssl version 0.10.70 fixes the signature of ssl::select_next_proto to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of ssl::select_next_proto in the callback passed to SslContextBuilder::set_alpn_select_callback, code is only affected if the server buffer is constructed within the callback.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-24898 rust-openssl 修正版: 0.10.29-1+deb11u1
参照URL
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web crates.io
- web lists.debian.org