CVE-2025-65495
📋 TL;DR
A signedness error in libcoap's TLS certificate verification allows remote attackers to cause denial of service. When i2d_X509() returns -1 due to a malicious certificate, this negative value is incorrectly used as a malloc() size parameter, leading to memory corruption. This affects systems using OISM libcoap 4.3.5 with TLS enabled.
💻 Affected Systems
- OISM libcoap
📦 What is this software?
Libcoap by Libcoap
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or complete service crash due to heap corruption from malformed malloc size.
Likely Case
Denial of service through application crash or memory exhaustion.
If Mitigated
Limited impact if TLS is disabled or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires sending a malicious TLS certificate to the vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.6 or later
Vendor Advisory: https://github.com/obgm/libcoap/issues/1744
Restart Required: Yes
Instructions:
1. Update libcoap to version 4.3.6 or later. 2. Recompile any applications using libcoap. 3. Restart affected services.
🔧 Temporary Workarounds
Disable TLS/DTLS
allDisable TLS certificate verification if not required for your use case.
Configure coap-server or client with --disable-tls flag if available
Network filtering
allBlock untrusted certificate sources at network perimeter.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Use reverse proxy with certificate validation before reaching vulnerable service
🔍 How to Verify
Check if Vulnerable:
Check libcoap version: dpkg -l libcoap* or rpm -qa | grep libcoapCheck Version:
coap-server --version 2>&1 | grep -i versionVerify Fix Applied:
Verify version is 4.3.6 or later and check that the patch from PR #1750 is applied.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory allocation errors
- Unexpected termination of coap services
Network Indicators:
- Malformed TLS certificates sent to coap ports (typically 5683, 5684)
SIEM Query:
source="coap.log" AND ("malloc" OR "segmentation fault" OR "certificate")