CVE-2025-4432: ring has some AES functions that may panic when overflow checking is enabled in
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.34667%
CWE
Published
5/9/2025
Updated
5/9/2025
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ring | rust | < 0.17.13 | 0.17.13 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability description states that a panic may be triggered when overflow checking is enabled in some AES functions. The provided commit ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38 directly addresses this issue. The patch modifies the increment_by_less_safe function within the Counter struct in src/aead/aes.rs. The change from old_value + increment_by.get() to old_value.wrapping_add(increment_by.get()) clearly indicates that the standard addition operator was causing an overflow panic under certain conditions, and wrapping_add was introduced as a mitigation. Therefore, ring::aead::aes::Counter::increment_by_less_safe is identified as the vulnerable function.