Overview
CVE-2025-65496 is a security vulnerability found in OISM’s libcoap version 4.3.5. Specifically, a NULL pointer dereference occurs within the coap_dtls_generate_cookie() function in the src/coap_openssl.c file. This flaw can be exploited by remote attackers to trigger a denial-of-service (DoS) condition on affected systems. The vulnerability is triggered by a specially crafted DTLS handshake that causes SSL_get_SSL_CTX() to return a NULL value.
Technical Details
The vulnerability arises when the coap_dtls_generate_cookie() function attempts to dereference a potentially NULL pointer returned by SSL_get_SSL_CTX() during a DTLS handshake. If the SSL context is not properly initialized or becomes invalid, this function can return NULL. The subsequent dereference of this NULL pointer leads to a program crash, effectively causing a denial of service.
The code snippet vulnerable to the NULL pointer dereference is in src/coap_openssl.c within the coap_dtls_generate_cookie() function.
CVSS Analysis
Due to the nature of the reported issue not having an associated CVSS score, it is important to evaluate the specific use case and potential impact. The vulnerability leads to a denial-of-service, which typically contributes to the availability metric. However, without official assigned values, a quantitative assessment is unavailable.
Possible Impact
The primary impact of CVE-2025-65496 is a denial-of-service. A successful exploit could render systems using the vulnerable libcoap version unavailable. This could disrupt services relying on the Constrained Application Protocol (CoAP), potentially impacting IoT devices and other applications that utilize this protocol.
Mitigation or Patch Steps
The recommended mitigation is to upgrade to a patched version of libcoap that addresses this vulnerability. The fix is available in a pull request on the libcoap GitHub repository. Specifically, apply the changes introduced in PR #1750. This pull request likely contains a fix to properly handle the NULL return from SSL_get_SSL_CTX(), preventing the dereference and the subsequent crash.
Users should also monitor the libcoap project for official releases containing this fix and promptly update their systems.
References
- libcoap Issue #1745 – Vulnerability Report
- libcoap Pull Request #1750 – Patch for the Vulnerability
