5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-624c-2h52-gf7f

GHSA-624c-2h52-gf7f: Duplicate Advisory: Remotely exploitable denial of service in Rosenpass

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6ggr-cwv4-g7qg. This link is maintained to preserve external references.

Original Description

The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-624c-2h52-gf7f

GHSA-624c-2h52-gf7f:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rosenpass	rust	< 0.2.1	0.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service caused by a panic when processing a specially crafted, undersized UDP packet. The root cause lies in the message parsing logic, which did not properly validate buffer lengths before accessing the data.

The primary function involved in the exploitation of this vulnerability is rosenpass::protocol::CryptoServer::handle_msg. This function acts as the main handler for all incoming network messages. It takes the raw byte slice from a UDP packet and passes it to more specific parsing functions.

The actual bug was in a macro named data_lense! located in rosenpass/src/msgs.rs. This macro generates parsing functions (like envelope, init_hello, etc.) for different message types. Before the fix, these generated functions did not check if the input buffer's length was sufficient for the message type they were supposed to parse. Consequently, when handle_msg received a packet that was too small (e.g., one byte) and passed it to one of these parsing functions, an out-of-bounds read would occur, triggering a panic and crashing the service.

The patch addresses this by modifying the data_lense! macro to insert a size check at the beginning of each generated parsing function, ensuring that any undersized packets are rejected with an error instead of causing a crash.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.