Listen to this Post
How the CVE works:
In OISM libcoap version 4.3.5, the function tls_verify_call_back() in src/coap_openssl.c handles DTLS handshake verification. During this process, it calls SSL_get_ex_data_X509_STORE_CTX_idx() to retrieve an index for accessing extended data in an OpenSSL X.509 store context. When a remote attacker sends a crafted DTLS handshake packet, this function can return -1, indicating an error or invalid index. The code fails to validate this return value and directly uses -1 as an array index. Since negative indices are out-of-bounds for arrays in C, this leads to memory corruption, such as segmentation faults or arbitrary memory access. This array index error crashes the application, causing a denial of service. The vulnerability is exploitable remotely without authentication, requiring only a malicious DTLS handshake to trigger the callback. The lack of bounds checking in the tls_verify_call_back() function makes libcoap instances susceptible to attacks, compromising availability in devices using this library for CoAP over DTLS.
Platform: OISM libcoap
Version: 4.3.5
Vulnerability: Array Index Error
Severity: Critical
Date: 2025-11-24
Prediction: Expected Patch 2025-12-15
What Undercode Say:
Analytics
Bash command to check version: `coap-client –version`
Code snippet from coap_openssl.c:
int idx = SSL_get_ex_data_X509_STORE_CTX_idx(); if (idx < 0) return; // Missing check void data = SSL_get_ex_data(ssl, idx); // Crash with -1
Compile vulnerable version: `./configure –with-openssl`
How Exploit:
Send crafted DTLS handshake.
Trigger SSL_get_ex_data_X509_STORE_CTX_idx() return -1.
Cause array out-of-bounds access.
Crash libcoap application.
Protection from this CVE:
Update libcoap version.
Apply vendor patches.
Validate OpenSSL indices.
Impact:
Denial of service.
Application crash.
Remote code disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
