Bug 2357560 (CVE-2025-3416, GHSA-4fcv-w3qc-ppgg) - CVE-2025-3416 openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`
Summary: CVE-2025-3416 openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher...
Keywords:
Status: NEW
Alias: CVE-2025-3416, GHSA-4fcv-w3qc-ppgg
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2357924 2357926 2357928 2357929 2357931 2357932 2357935 2357936 2357938 2357940 2357941 2357943 2357944 2357922 2357923 2357925 2357927 2357930 2357933 2357934 2357937 2357939 2357942
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-04 21:02 UTC by OSIDB Bzimport
Modified: 2025-04-08 18:05 UTC (History)
29 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-04 21:02:38 UTC
When a `Some(...)` value was passed to the `properties` argument of either of these functions, a use-after-free would result.

In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to `CString::drop`'s behavior).

The maintainers thank [quitbug](https://github.com/quitbug/) for reporting this vulnerability to us.

Comment 2 Fabio Valentini 2025-04-07 21:47:29 UTC
How did you determine which Rust applications to file bugs against?
I was surprised to see that bugs were filed against *some* applications (but not all) that use the OpenSSL bindings from the "openssl" Rust crate, but no bug was filed against "rust-openssl" itself.

Comment 3 Fabio Valentini 2025-04-08 16:15:32 UTC
I have now looked at the source code of all packages that depend on "rust-openssl", and only *one* of them has a reference to `Cipher::fetch` - python-cryptography, and it doesn't use the function in a way that triggers this CVE. There are zero references to `Md::fetch` in any packages that depend on "rust-openssl". I'll go ahead close all bugs that were reported against packages that are definitely not affected by this issue.

Again, I'm surprised that bugs were opened against "maturin" and "rustup" - neither use code from the "openssl" crate directly. The only package that *could* be affected (because it calls `Cipher::fetch`) is "python-cryptography", and it's one of the few packages that didn't get a bug reported against it 🤣

Note that I have *not* checked packages that vendor the "openssl" crate.


Note You need to log in before you can comment on or make changes to this bug.