Overview
CVE-2025-65494 describes a NULL pointer dereference vulnerability found in OISM libcoap version 4.3.5. This vulnerability resides in the get_san_or_cn_from_cert() function within the src/coap_openssl.c file. A remote attacker can exploit this flaw to trigger a denial-of-service (DoS) condition by sending a specially crafted X.509 certificate to a vulnerable server. The vulnerability occurs when the sk_GENERAL_NAME_value() function unexpectedly returns NULL, leading to a NULL pointer dereference within the calling code.
Technical Details
The get_san_or_cn_from_cert() function is responsible for extracting the Subject Alternative Name (SAN) or Common Name (CN) from an X.509 certificate. The function iterates through the GENERAL_NAME entries within the certificate. The vulnerability arises if sk_GENERAL_NAME_value() returns NULL, which can happen if a malformed or unexpected structure is present within the certificate. Without proper NULL checking, the code attempts to dereference this NULL pointer, causing the application to crash and resulting in a denial of service.
Specifically, the vulnerability lies in the lack of a null check after the call to `sk_GENERAL_NAME_value()`. If this function returns `NULL` (indicating an error or unexpected data within the X.509 certificate), the subsequent code attempts to access a member of the `NULL` pointer, causing a crash.
CVSS Analysis
Currently, the severity and CVSS score for CVE-2025-65494 are listed as N/A. This might be because the initial analysis is pending or the score is still being calculated. However, given that it leads to a denial of service, a moderate to high severity score is anticipated, especially if exploitation is relatively easy.
Possible Impact
Successful exploitation of CVE-2025-65494 allows a remote attacker to cause a denial of service. This can disrupt the availability of services relying on libcoap, potentially impacting critical infrastructure or applications that utilize the Constrained Application Protocol (CoAP). The DoS can be triggered by simply sending a malicious X.509 certificate to a vulnerable server, making it relatively easy to exploit.
Mitigation or Patch Steps
The recommended mitigation is to upgrade to a patched version of libcoap. A patch has been submitted and is available. Specifically, pull request #1750 implements the necessary null check to prevent the NULL pointer dereference. Users are advised to apply this patch or upgrade to a version of libcoap that includes this fix. Until an upgrade is possible, consider implementing input validation and sanitization on X.509 certificates to detect and reject potentially malicious certificates.
References
- CVE: CVE-2025-65494
- GitHub Issue: https://github.com/obgm/libcoap/issues/1745
- GitHub Pull Request (Patch): https://github.com/obgm/libcoap/pull/1750
