rust openssl ssl::select_next_proto use after free
Summary
rust openssl ssl::select_next_proto use after free
Original description
The description as published by the source.
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::select_next_proto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the sever buffer's lifetime is shorter than the client buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crateopenssl version 0.10.70 fixes the signature of ssl::select_next_proto to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of ssl::select_next_proto in the callback passed to SslContextBuilder::set_alpn_select_callback, code is only affected if the server buffer is constructed within the callback.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-24898 rust-openssl Fixed in: 0.10.29-1+deb11u1
References
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web crates.io
- web lists.debian.org