CVE-2025-15382
📋 TL;DR
This heap buffer over-read vulnerability in wolfSSH's wolfSSH_CleanPath() function allows authenticated remote attackers to read one byte beyond allocated memory boundaries via crafted SCP paths containing '/./' sequences. Systems using vulnerable versions of wolfSSH for SSH/SCP functionality are affected, potentially exposing sensitive memory contents.
💻 Affected Systems
- wolfSSH
📦 What is this software?
Wolfssh by Wolfssh
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of adjacent heap memory containing sensitive data such as passwords, keys, or session tokens, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited information disclosure of adjacent memory contents.
If Mitigated
Minimal impact with proper memory protections (ASLR, stack canaries) and network segmentation limiting attacker access.
🎯 Exploit Status
Requires authenticated access and specific path manipulation knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing PR #859 fix
Vendor Advisory: https://github.com/wolfSSL/wolfssh/pull/859
Restart Required: Yes
Instructions:
1. Update wolfSSH to version containing PR #859 fix. 2. Recompile applications using wolfSSH. 3. Restart affected services.
🔧 Temporary Workarounds
Disable SCP functionality
allDisable SCP protocol support in wolfSSH configuration
Configure wolfSSH to disable SCP subsystem
Restrict authenticated user access
allLimit SCP access to trusted users only
Configure SSH access controls and user permissions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy memory protection mechanisms (ASLR, stack canaries) and monitor for crashes
🔍 How to Verify
Check if Vulnerable:
Check wolfSSH version against patched version from PR #859Check Version:
Check wolfSSH library version or application documentationVerify Fix Applied:
Verify wolfSSH version is updated beyond PR #859 fix📡 Detection & Monitoring
Log Indicators:
- SCP requests with unusual path patterns containing '/./' sequences
- Application crashes or memory access violations in wolfSSH logs
Network Indicators:
- SCP traffic with manipulated path parameters
- Repeated SCP connection attempts with varying paths
SIEM Query:
source="ssh_logs" AND (path="*/./*" OR error="buffer" OR error="memory")