CVE-2025-29913: CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflow
First published: Mon Mar 17 2025(Updated: )
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_TC_Prep_AAD` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted telecommand (TC) frame that causes an unsigned integer underflow. The vulnerability lies in the function `Crypto_TC_Prep_AAD`, specifically during the computation of `tc_mac_start_index`. The affected code incorrectly calculates the MAC start index without ensuring it remains within the bounds of the `ingest` buffer. When `tc_mac_start_index` underflows due to an incorrect length calculation, the function attempts to access an out-of-bounds memory location, leading to a segmentation fault. The vulnerability is still present in the repository as of commit `d3cc420ace96d02a5b7e83d88cbd2e48010d5723`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CryptoLib | <1.3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-29913?
The severity of CVE-2025-29913 is critical due to the heap buffer overflow vulnerability in CryptoLib.
How do I fix CVE-2025-29913?
To fix CVE-2025-29913, update CryptoLib to version 1.3.4 or later, which addresses the heap buffer overflow issue.
What are the potential impacts of CVE-2025-29913?
CVE-2025-29913 can lead to remote code execution, denial of service, or data corruption if exploited.
Which versions of CryptoLib are affected by CVE-2025-29913?
CryptoLib versions prior to 1.3.4 are affected by CVE-2025-29913.
Is CVE-2025-29913 related to specific systems?
CVE-2025-29913 specifically affects the CCSDS Space Data Link Security Protocol implementation within CryptoLib.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/cryptolib
- canonical/cryptolib