CVE-2025-65500
📋 TL;DR
A NULL pointer dereference vulnerability in OISM libcoap's DTLS cookie generation function allows remote attackers to cause denial of service. Attackers can trigger this by sending a crafted DTLS handshake that causes SSL_get_SSL_CTX() to return NULL. This affects systems using vulnerable versions of libcoap with DTLS enabled.
💻 Affected Systems
- OISM libcoap
📦 What is this software?
Libcoap by Libcoap
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the affected CoAP/DTLS service, requiring restart of the application or service.
Likely Case
Service crash or hang affecting CoAP/DTLS functionality, potentially disrupting IoT or constrained device communications.
If Mitigated
Minimal impact if DTLS is disabled or if the service has automatic restart capabilities.
🎯 Exploit Status
Exploitation requires sending a crafted DTLS handshake packet to trigger the NULL pointer dereference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in libcoap 4.3.6 and later
Vendor Advisory: https://github.com/obgm/libcoap/issues/1746
Restart Required: Yes
Instructions:
1. Update libcoap to version 4.3.6 or later. 2. Recompile applications using libcoap. 3. Restart affected services.
🔧 Temporary Workarounds
Disable DTLS
allDisable DTLS support in libcoap configuration if not required
Recompile libcoap with --disable-dtls configure option
Modify application code to not use coap_dtls_* functions
Network filtering
linuxBlock or restrict access to CoAP/DTLS ports (typically 5684/udp)
iptables -A INPUT -p udp --dport 5684 -j DROP
firewall-cmd --permanent --add-rich-rule='rule protocol value="udp" drop'
🧯 If You Can't Patch
- Implement network segmentation to isolate CoAP/DTLS services from untrusted networks
- Deploy intrusion prevention systems (IPS) to detect and block crafted DTLS handshake attempts
🔍 How to Verify
Check if Vulnerable:
Check libcoap version: dpkg -l | grep libcoap or rpm -qa | grep libcoap. If version is 4.3.5 and DTLS is enabled, system is vulnerable.Check Version:
pkg-config --modversion libcoap-3 || coap-client --version 2>/dev/null | head -1Verify Fix Applied:
Verify libcoap version is 4.3.6 or later and test DTLS functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Application crashes or segmentation faults in coap_dtls_generate_cookie
- Unexpected service restarts of CoAP/DTLS services
Network Indicators:
- Multiple DTLS handshake attempts from single source followed by service disruption
- Unusual DTLS packet patterns to port 5684/udp
SIEM Query:
source="*coap*" AND ("segmentation fault" OR "null pointer" OR "SIGSEGV")