CVE-2025-34450: 
NixOS vulnerability analysis and mitigation

CVE-2025-34450 is a stack-based buffer overflow vulnerability in the parse_rfraw() function (src/rfraw.c) of the open-source RF signal decoder tool merbanan/rtl_433. Affecting all versions up to and including 25.02 (prior to commit 25e47f8), the flaw allows an attacker to supply crafted or excessively large raw RF input data that writes beyond the bounds of a stack buffer, causing memory corruption or a crash. It was discovered and reported by Vlatko Kosturjak of Marlink Cyber on October 8, 2025, and publicly disclosed on December 18, 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Marlink Advisory, GitHub Issue).

The root cause is insufficient bounds checking on input data lengths in parse_rfraw() (CWE-121: Stack-based Buffer Overflow; CWE-787: Out-of-bounds Write). When processing raw RF data — supplied via the -r or -H command-line options or a test file via -y — the function copies pulse data into a fixed-size stack buffer (pulse_data) without verifying that the number of pulses does not exceed PD_MAX_PULSES, allowing a write past the end of the buffer at src/rfraw.c:158. The fix (commit 25e47f8) adds a bounds check to abort reading when data->num_pulses >= PD_MAX_PULSES and guards the repeat-expansion loop with a similar check. AddressSanitizer confirms the overflow as a WRITE of size 4 at stack offset 20152, overflowing the pulse_data variable into adjacent stack objects including decoders_str and line (Marlink Advisory, GitHub Commit).

The primary confirmed impact is denial of service via application crash due to stack memory corruption. Because the overflow can overwrite adjacent stack variables and potentially return addresses, control-flow alteration and arbitrary code execution are theoretically possible depending on the execution environment and available mitigations (e.g., absence of stack canaries or ASLR). Confidentiality, integrity, and availability are all rated High under CVSS v3.1, reflecting the potential for full local compromise in worst-case scenarios (Marlink Advisory, Feedly).

A proof-of-concept exploit (a crafted overflow.txt test file) is publicly available via the Marlink Cyber advisory and the upstream GitHub issue, demonstrating reliable crash reproduction under ASAN on Ubuntu 24.04. The EPSS score is very low (0.000150), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the time of disclosure. No threat actor attribution has been reported (Marlink Advisory, GitHub Issue, Feedly).

1. Prepare malicious input: Craft a raw RF data file (overflow.txt) containing an excessively large number of pulse entries that exceeds the PD_MAX_PULSES limit expected by parse_rfraw() in src/rfraw.c.
2. Invoke rtl_433 with the crafted file: Run src/rtl_433 -y @/path/to/overflow.txt to direct the application to parse the malicious test data file, triggering the parse_rfraw() code path.
3. Trigger the overflow: As parse_rfraw() processes the pulse entries without bounds checking, it writes a 4-byte value past the end of the pulse_data stack buffer at offset 20152, corrupting adjacent stack variables (decoders_str, line, and potentially return addresses).
4. Achieve denial of service (or further exploitation): The application crashes (confirmed via ASAN as stack-buffer-overflow). In environments lacking stack canaries or ASLR, an attacker may attempt to craft the payload to overwrite a return address and redirect execution flow for code execution (Marlink Advisory, GitHub Issue).

• Process: Unexpected crash or abort of the rtl_433 process; presence of core dump files in the working directory associated with rtl_433.
• Logs: Application output containing AddressSanitizer: stack-buffer-overflow or ABORTING messages referencing src/rfraw.c:158 in parse_rfraw; OS-level crash reports (e.g., dmesg segfault entries) for the rtl_433 process.
• File System: Presence of unusually large or malformed RF raw data files (e.g., .txt files with excessive pulse entries) passed to rtl_433 via -y, -r, or -H options.
• Network: If rtl_433 is receiving data from a network source (e.g., rtl_tcp), anomalously large or malformed data streams from unexpected remote hosts (Marlink Advisory).

Users should upgrade rtl_433 to a version that includes commit 25e47f8 or any release beyond 25.02 (e.g., 25.12 or later with the fix applied). The patch adds a bounds check in parse_rfraw() to abort processing when data->num_pulses >= PD_MAX_PULSES and guards the repeat-expansion loop similarly. As interim mitigations, restrict local access to systems running rtl_433, avoid processing RF input from untrusted sources, and run the application inside a restricted sandbox. Enabling OS-level mitigations such as ASLR and stack canaries (compile with -fstack-protector) reduces the risk of exploitation beyond denial of service (GitHub Commit, Marlink Advisory).