CVE-2025-34451: 
NixOS vulnerability analysis and mitigation

CVE-2025-34451 is a stack-based buffer overflow vulnerability in proxychains-ng's proxy_from_string() function located in src/libproxychains.c. It affects all versions up to and including 4.17 (prior to commit cc005b7), and was discovered by Vlatko Kosturjak of Marlink Cyber, reported on 2025-10-18, published on 2025-10-20, and assigned a CVE on 2025-12-18. The vulnerability has a CVSS v3.1 base score of 7.8 (High) (Marlink Advisory, Feedly).

The root cause (CWE-121: Stack-based Buffer Overflow, CWE-787: Out-of-bounds Write) is a missing unconditional bounds check in proxy_from_string(). The original code only enforced a length check (ul > 255 || pl > 255) when the proxy type was SOCKS5, leaving HTTP proxy entries unchecked. Subsequent memcpy() calls then copied attacker-controlled username (ul bytes) and password (pl bytes) into fixed 256-byte stack buffers (user_buf/pass_buf) without size validation, enabling a stack overflow. The fix, applied in commit cc005b7, removes the proxytype == RS_PT_SOCKS5 condition so the bounds check applies unconditionally:

- if(proxytype == RS_PT_SOCKS5 && (ul > 255 || pl > 255))
+ if(ul > 255 || pl > 255)
    return 0;

Exploitation requires supplying a crafted proxy configuration file with an HTTP proxy entry containing a username or password field exceeding 255 bytes (Marlink Advisory, GitHub Issue #606).

The primary impact is denial of service through application crash due to stack memory corruption when proxychains-ng parses a malicious configuration file. A secondary impact — potential arbitrary code execution — exists depending on the execution environment, compiler mitigations (e.g., stack canaries, ASLR, NX), and calling context. Confidentiality, integrity, and availability are all rated High under CVSS v3.1, reflecting the potential for full process compromise if memory protections are insufficient (Marlink Advisory, Feedly).

Multiple proof-of-concept exploits are publicly available, including a detailed PoC configuration file and ASAN-confirmed reproduction steps published in the GitHub issue and Marlink Cyber advisory. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.015% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (Marlink Advisory, GitHub Issue #606, Feedly).

1. Craft a malicious configuration file: Create a proxychains-ng configuration file (poc_config_minimal.conf) containing an HTTP proxy entry with a username or password field exceeding 255 bytes, e.g.:

   [ProxyList]
   http 127.0.0.1 8080 AAAA...AAA(>255 chars) password

2. Deliver the configuration: Place the malicious config file in a location that the target user or process will load — either by social engineering, compromising a configuration distribution system, or exploiting a misconfiguration that allows config file substitution.
3. Trigger parsing: Cause proxychains-ng to read the malicious configuration, e.g., by running:

   ./proxychains4 -f poc_config_minimal.conf /bin/true

4. Observe overflow: The proxy_from_string() function skips the bounds check for HTTP proxy types and executes memcpy(user_buf, u, ul) with ul > 255, overwriting stack memory beyond the 256-byte user_buf buffer.
5. Achieve DoS or code execution: Depending on compiler mitigations, the overflow causes an immediate crash (DoS) or, in environments without stack canaries or with exploitable stack layouts, may enable control of the instruction pointer for code execution (Marlink Advisory, GitHub Issue #606).

• File System: Presence of unexpected or externally-supplied proxychains configuration files (e.g., proxychains.conf, proxychains4.conf) containing HTTP proxy entries with unusually long username or password fields (>255 characters).
• Logs: Application crash logs or core dumps associated with the proxychains4 process; ASAN output referencing stack-buffer-underflow in proxy_from_string() or libproxychains.c.
• Process: Unexpected termination (SIGABRT/SIGSEGV) of processes launched via proxychains-ng; child processes of proxychains4 that exit abnormally without completing their task.
• Network: No direct network-based IOCs, as exploitation is local and configuration-file-driven (Marlink Advisory).

Upgrade proxychains-ng to a version incorporating commit cc005b7132811c9149e77b5e33cff359fc95512e or later, which enforces an unconditional bounds check on username and password lengths. For distributions that cannot immediately upgrade, apply the single-line backport patch to src/libproxychains.c and rebuild:

- if(proxytype == RS_PT_SOCKS5 && (ul > 255 || pl > 255))
+ if(ul > 255 || pl > 255)
    return 0;

As an operational workaround, restrict access to systems running vulnerable versions and carefully control proxy configuration sources to prevent malicious entries from being processed. Fedora has issued an updated package addressing this vulnerability (Marlink Advisory, Patch Commit, Feedly).

The vulnerability was responsibly disclosed by Vlatko Kosturjak of Marlink Cyber, who published a detailed advisory (MCSAID-2025-008) and coordinated with the upstream maintainer. The fix was merged promptly by the project maintainer (rofl0r) with the commit message "fix potential buffer overflow in config file parsing." Fedora issued a security update for proxychains-ng in response, and the issue received coverage from Linux security news outlets (Marlink Advisory, Patch Commit).