GHSA-HPPC-G8H3-XHP3: GHSA-HPPC-G8H3-XHP3: Out-of-Bounds Read via Unchecked Callback Length in rust-openssl

#security #cve #cybersecurity #ghsa

GHSA-HPPC-G8H3-XHP3: Out-of-Bounds Read via Unchecked Callback Length in rust-openssl

Vulnerability ID: GHSA-HPPC-G8H3-XHP3
CVSS Score: 7.5
Published: 2026-04-22

The openssl crate for Rust contains a critical memory disclosure vulnerability within its FFI trampolines for Pre-Shared Key (PSK) and TLS/DTLS cookie callbacks. By failing to validate the return length from user-provided closures, the library allows OpenSSL to perform an out-of-bounds read. This flaw enables an unauthenticated remote attacker to extract adjacent heap or stack memory during the TLS handshake process.

TL;DR

A missing bounds check in rust-openssl's FFI callbacks allows unauthenticated attackers to read adjacent process memory if a custom PSK or DTLS cookie callback returns a length exceeding the provided buffer.

Technical Details

CWE ID: CWE-125, CWE-201
Attack Vector: Network
Authentication: None Required
CVSS 3.1 Score: 7.5
Impact: High (Confidentiality)
Affected Component: FFI Trampolines in openssl crate

Affected Systems

Rust applications using the openssl crate with custom PSK callbacks
Rust applications using the openssl crate with custom DTLS cookie callbacks
openssl (Rust crate): < 0.10.78 (Fixed in: 0.10.78)

Code Analysis

Commit: 1d10902

Fix unchecked callback length in PSK/cookie trampolines

Mitigation Strategies

Upgrade the openssl crate to version 0.10.78
Audit custom PSK and cookie closures to enforce strict bounds validation before returning the length
Fuzz custom callbacks to verify boundary adherence under malformed input conditions
Monitor for anomalously large TLS ServerHello or DTLS HelloVerifyRequest payloads

Remediation Steps:

Update the Cargo.toml dependency to require openssl version >= 0.10.78
Run 'cargo update -p openssl' to lock the patched dependency
Rebuild the application to compile the updated FFI trampolines
Deploy the updated application to all affected environments
Review callback implementations in source code to ensure defensive length calculations

References

Read the full report for GHSA-HPPC-G8H3-XHP3 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community