CVE-2025-24898 rust openssl ssl::select_next_proto use after free
A use-after-free in rust-openssl allows attackers to crash the server or leak memory contents via improper lifetime handling in ALPN selection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24898?
CVE-2025-24898 is a medium-severity use after free vulnerability in sfackler rust-openssl, published on 3 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.
Weakness: CWE-416
Which versions are affected by CVE-2025-24898?
3 open source packages ship an affected version, including openssl.
| Package | Affected | Fixed in |
|---|---|---|
openssl crates.io | From 0.0.0-0 | 0.10.70 |
openssl crates.io | From 0.10.0 | 0.10.70 |
openssl crates.io | From 0.10.0 | 0.10.70 |
Linux distribution packages (32)
bootc AlmaLinux:9 | All versions | 1.1.6-3.el9_6 |
bootupd AlmaLinux:9 | All versions | 0.2.27-3.el9 |
keylime-agent-rust AlmaLinux:9 | All versions | 0.2.2-2.el9 |
python3.12-cryptography AlmaLinux:9 | All versions | 41.0.7-2.el9 |
rpm-ostree AlmaLinux:9 | All versions | 2025.5-1.el9 |
rpm-ostree-libs AlmaLinux:9 | All versions | 2025.5-1.el9 |
system-reinstall-bootc AlmaLinux:9 | All versions | 1.1.6-3.el9_6 |
bootc Red Hat:enterprise_linux:9::appstream | All versions | 0:1.1.6-3.el9_6 |
bootc-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.1.6-3.el9_6 |
bootc-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.1.6-3.el9_6 |
bootupd Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.27-3.el9 |
bootupd-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.27-3.el9 |
keylime-agent-rust Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.2-2.el9 |
keylime-agent-rust-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.2-2.el9 |
keylime-agent-rust-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.2-2.el9 |
python3.12-cryptography Red Hat:enterprise_linux:9::appstream | All versions | 0:41.0.7-2.el9 |
python3.12-cryptography-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:41.0.7-2.el9 |
python3.12-cryptography-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:41.0.7-2.el9 |
rpm-ostree Red Hat:enterprise_linux:9::appstream | All versions | 0:2025.5-1.el9 |
rpm-ostree-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2025.5-1.el9 |
rpm-ostree-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:2025.5-1.el9 |
rpm-ostree-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:2025.5-1.el9 |
rpm-ostree-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2025.5-1.el9 |
rust-bootupd Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.27-3.el9 |
rust-bootupd-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.2.27-3.el9 |
system-reinstall-bootc Red Hat:enterprise_linux:9::appstream | All versions | 0:1.1.6-3.el9_6 |
system-reinstall-bootc-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.1.6-3.el9_6 |
bootc Rocky Linux:9 | All versions | 0:1.1.6-3.el9_6 |
keylime-agent-rust Rocky Linux:9 | All versions | 0:0.2.2-2.el9 |
python3.12-cryptography Rocky Linux:9 | All versions | 0:41.0.7-2.el9 |
rust-bootupd Rocky Linux:9 | All versions | 0:0.2.27-3.el9 |
obs-service-cargo openSUSE:Tumbleweed | All versions | 4.5.0-2.1 |
How do I fix CVE-2025-24898?
Upgrade openssl to 0.10.70 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-24898 being exploited?
There is no known exploitation of CVE-2025-24898 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:7147, ALSA-2025:7160, ALSA-2025:7241, ALSA-2025:7313, ALSA-2025:7317, AZL-56427 and 20 more.