CVE-2025-34457: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-34457 is a stack-based buffer overflow vulnerability in Dire Wolf (wb2osz/direwolf), an amateur radio software TNC (Terminal Node Controller), affecting all versions up to and including 1.8 (prior to commit 694c954). The flaw exists in the kiss_rec_byte() function in src/kiss_frame.c, where crafted KISS frames at the maximum allowed frame length trigger an out-of-bounds write and subsequent out-of-bounds read, leading to stack memory corruption or application crashes. It was reported on 2025-11-04, published on 2025-11-16, and disclosed publicly on 2025-12-22. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (Marlink Advisory, Red Hat).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). In the KS_COLLECTING state of kiss_rec_byte(), non-FEND bytes are accumulated up to MAX_KISS_LEN, but the boundary check (if (kf->kiss_len < MAX_KISS_LEN)) does not reserve space for the terminating FEND byte that must be appended to complete the frame. When a KISS frame reaches exactly MAX_KISS_LEN, the FEND byte is written one position beyond the allocated stack buffer, causing an out-of-bounds write. The subsequent call to kiss_unwrap() at src/kiss_frame.c:322 then reads from this corrupted stack memory, resulting in a stack-buffer-overflow confirmed by AddressSanitizer. Exploitation requires only network access to the KISS TCP port (typically port 7002) with no authentication or user interaction required (Marlink Advisory, GitHub Issue #617).

The primary impact is a Denial of Service (DoS) condition caused by stack memory corruption and application crash. A remote unauthenticated attacker can send a crafted binary payload to the KISS TCP port to reliably crash the Dire Wolf daemon, disrupting amateur radio packet operations and any dependent services. A secondary, theoretical impact exists: without memory sanitizers, the stack corruption may clobber adjacent variables, potentially enabling control-flow corruption or daemon destabilization, though no such exploitation has been demonstrated (Marlink Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is trivially triggerable by sending a crafted binary payload via netcat to the KISS TCP port, as demonstrated in the original disclosure using a PoC binary (poc_kiss_overflow.bin) shared in the GitHub issue. The EPSS score is approximately 0.118%, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Issue #617, Marlink Advisory).

1. Reconnaissance: Identify hosts running Dire Wolf with KISS TCP enabled (default port 7002) using network scanning tools such as nmap (nmap -p 7002 <target>). Confirm the service is accessible and the version is ≤1.8 or pre-commit 694c954.
2. Craft malicious KISS frame: Construct a binary payload that fills the KISS frame buffer to exactly MAX_KISS_LEN bytes with non-FEND bytes, followed by a FEND byte (0xC0). This forces kiss_rec_byte() to attempt writing the terminating FEND byte one position beyond the allocated stack buffer.
3. Deliver payload: Send the crafted binary payload to the KISS TCP port using a tool such as netcat: ncat <target_ip> 7002 < poc_kiss_overflow.bin.
4. Trigger overflow: The kiss_rec_byte() function writes the FEND byte out-of-bounds, corrupting the stack. The subsequent call to kiss_unwrap() reads from the corrupted memory.
5. Achieve DoS: The Dire Wolf process crashes (aborts with AddressSanitizer, or silently corrupts state without sanitizers), resulting in a denial-of-service condition (GitHub Issue #617, Marlink Advisory).

• Network: Unexpected or repeated TCP connections to port 7002 (KISS TCP port) from unknown or untrusted IP addresses; large binary payloads (~2049 bytes) sent to the KISS port.
• Logs: Dire Wolf log output containing KISS message exceeded maximum length. repeated in rapid succession; log entries showing KISS frame should end with FEND and KISS frame should not have FEND in the middle errors.
• Process: Unexpected termination or crash of the direwolf process; if compiled with AddressSanitizer, an ==ERROR: AddressSanitizer: stack-buffer-overflow message in stderr referencing kiss_frame.c:322 in kiss_unwrap.
• File System: Core dump files generated by the direwolf process in the working directory following a crash (GitHub Issue #617, Marlink Advisory).

The fix is available in commit 694c95485b21c1c22bc4682703771dec4d7a374b, which changes the boundary check in src/kiss_frame.c from if (kf->kiss_len < MAX_KISS_LEN) to if (kf->kiss_len < MAX_KISS_LEN - 1), reserving space for the terminating FEND byte. Users should upgrade to a version of Dire Wolf that includes or follows this commit. As a temporary workaround if immediate upgrade is not possible: restrict network access to the KISS TCP port (default 7002) to trusted clients only using firewall rules, or disable KISS TCP functionality entirely if not required. Backporting the single-line patch to src/kiss_frame.c:485 and rebuilding is also an option for packaged distributions (Marlink Advisory, GitHub Commit 694c954).

The vulnerability was discovered by Vlatko Kosturjak of Marlink Cyber and responsibly disclosed to the Dire Wolf project maintainer, who promptly issued a fix in commit 694c954. Red Hat tracked the issue via Bugzilla (Bug 2424513) and assigned it high severity. Coverage appeared on security aggregators including VulnCheck, INCIBE-CERT, and Pro-Linux.de, reflecting moderate community interest given the niche amateur radio user base (Marlink Advisory, Red Hat Bugzilla).