CVE-2025-13151: 
NixOS vulnerability analysis and mitigation

CVE-2025-13151 is a stack-based buffer overflow vulnerability in GNU libtasn1 version 4.20.0 and earlier, specifically in the asn1_expand_octet_string function located in decoding.c. The flaw arises from unsafe string concatenation that fails to validate input size, resulting in a one-byte stack overflow that may corrupt adjacent memory. It was publicly disclosed on January 7–8, 2026, with the fix released in libtasn1 version 4.21.0 on January 8, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (CERT/CC VU#271649, Openwall OSS-Sec).

The root cause is classified as CWE-787 (Out-of-bounds Write). The vulnerability exists in asn1_expand_octet_string in decoding.c, where unbounded string manipulation functions (strcpy and strcat) are used to construct a local stack buffer (name) by concatenating definitions->name, a separator character (.), and p2->name. In the worst case, when both source strings are at their maximum allowed length, the destination buffer is undersized by exactly one byte, causing the final null terminator written by strcat to overflow the stack buffer by a single byte. Exploitation requires supplying malformed ASN.1 input to an application using libtasn1, which assumes the library will parse potentially untrusted data — a common scenario in cryptographic certificate parsing and signature verification workflows. The patch is available via a GitLab merge request replacing unbounded operations with bounded alternatives (CERT/CC VU#271649, GitLab MR #121).

The primary impact is denial of service: an unauthenticated remote attacker can send specially crafted ASN.1-encoded data to crash applications that use libtasn1 for parsing, including those performing TLS certificate validation via GnuTLS. While the overflow is limited to a single byte, it can cause memory corruption, parsing failures, or abnormal behavior during critical cryptographic operations such as signature verification and certificate parsing. The confidentiality and integrity impacts are assessed as none; however, the availability impact is rated high. Modern compiler protections (stack canaries, _FORTIFY_SOURCE) may mitigate exploitation beyond a crash, but the library's widespread use in security-sensitive contexts amplifies the risk (CERT/CC VU#271649, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.04%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the one-byte overflow nature and modern compiler hardening mechanisms such as stack canaries (Feedly, CERT/CC VU#271649).

The primary remediation is to upgrade libtasn1 to version 4.21.0 or later, released January 8, 2026, which replaces unsafe unbounded string operations with bounded alternatives (Openwall OSS-Sec). Downstream distributions have released patches including: Slackware (SSA-2026-008-01), Ubuntu (USN-7954-1, USN-7954-2), Fedora (libtasn1 and mingw-libtasn1 updates), SUSE, Mageia, and Amazon Linux 2 (ALAS2-2026-3143). Oracle addressed the vulnerability in its April 2026 Critical Patch Update, and Microsoft published updates for affected CBL-Mariner and Azure Linux packages (Oracle CPU Apr 2026, Microsoft MSRC). As a temporary workaround where patching is not immediately possible, restrict network access to applications that use libtasn1 for ASN.1 parsing, and ensure compiler hardening flags (stack canaries, _FORTIFY_SOURCE) are enabled.

The vulnerability was coordinated through CERT/CC (VU#271649), with Benny Zelster from Microsoft Research credited for coordinating disclosure, and Vijay Sarvepalli of CERT/CC authoring the advisory (CERT/CC VU#271649). The fix was announced by Simon Josefsson on the GNU project mailing list alongside the libtasn1 4.21.0 release. The vulnerability received coverage in The Hacker News weekly recap and was noted across Linux security communities including Slackware, Fedora, Ubuntu, and openSUSE mailing lists. Social media discussion was limited, with brief mentions on Mastodon and Bluesky from security-focused accounts.