CVE-2025-24898

A flaw was found in the rust-openssl package. In certain versions, ssl::select_next_proto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the sever buffer's lifetime is shorter than the client buffer's, this can cause a use-after-free error. This could cause the server to crash or return arbitrary memory contents to the client.

This Moderate-impact flaw affects Red Hat products that use the vulnerable rust-openssl functionality. In affected versions, ssl::select_next_proto can return a slice into the server buffer while its lifetime is tied only to the client buffer; if the server buffer is created within the callback and has a shorter lifetime, this can cause a use-after-free, potentially crashing the server or returning arbitrary memory contents to the client. Current affects identify affected records in Red Hat Enterprise Linux for rust-bootupd, python3.12-cryptography, bootc, keylime-agent-rust, and rpm-ostree, with trustee-guest-components and fido-device-onboard marked DEFER; the RHEL 8.4, 8.6, 8.8, and 8.10 python3.12-cryptography records and RHEL 9.6 sevctl record have delegated NOTAFFECTED resolutions, including vulnerable code not in the execute path where specified. Other Red Hat Enterprise Linux, Red Hat Directory Server, and Community Projects records are not affected because the vulnerable code is not present or not in the execute path. The Red Hat CVSS assessment is Moderate (4.8, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L), consistent with the upstream Moderate rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users should upgrade to an available vendor-provided update. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.