CVE-2025-34458: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-34458 is a reachable assertion vulnerability in Dire Wolf (wb2osz/direwolf), an open-source software-based AX.25 packet radio modem and APRS decoder. Affecting all versions up to and including 1.8 (prior to commit 3658a87), the flaw resides in the APRS MIC-E decoder function aprs_mic_e() in src/decode_aprs.c. A remote, unauthenticated attacker can trigger an assertion failure by sending a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, causing immediate process termination. The vulnerability was reported on November 5, 2025, and publicly disclosed on December 22, 2025, with a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, GitHub Issue #618, Red Hat Bugzilla).

The root cause is classified as CWE-617 (Reachable Assertion). In aprs_mic_e(), after copying the comment field from the incoming packet into a local buffer via strlcpy, the code executes assert(strlen(mcomment) > 0). When a crafted AX.25 frame contains a null byte near the end of the MIC-E packet (which is abnormal for valid APRS traffic), strlen() returns zero even though the byte count of the packet suggests a non-empty comment, triggering the assertion and aborting the process. The attack vector is network-based (AV:N), requires no privileges or user interaction, and has low attack complexity — any Dire Wolf component that calls decode_aprs for parsing is exposed. The fix in commit 3658a87 replaces the hard assertion with a conditional check that gracefully handles the empty-comment case by returning early (GitHub Issue #618, Fix Commit 3658a87).

Successful exploitation causes immediate and complete termination of the Dire Wolf process, resulting in a full denial of service for any system relying on Dire Wolf for APRS packet decoding, digipeating, or gateway functions. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. In amateur radio and emergency communications contexts where Dire Wolf serves as a critical APRS infrastructure component, repeated exploitation could disrupt packet radio networks and associated communication services (Red Hat Advisory, GitHub Issue #618).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time. However, the GitHub issue report includes a minimal test case (a specific hex byte sequence) that reproducibly triggers the crash, making the vulnerability straightforward to replicate by a motivated attacker. The EPSS score is 0.0013 (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Issue #618, Red Hat Advisory).

1. Reconnaissance: Identify systems running Dire Wolf by scanning for open APRS-IS ports (TCP 14580), KISS TCP ports (default 7002), or AGW ports (default 8000), or by monitoring RF APRS traffic for beacon frames identifying Dire Wolf as the software.
2. Craft malicious AX.25 frame: Construct a valid AX.25 frame that decodes as a MIC-E message but contains a null byte (\x00) near the end of the comment field, causing strlen() to return 0 on the extracted comment. The proof-of-concept byte sequence from the issue report is: 27 27 27 27 27 27 27 27 10 00 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 9e a6 a6 a6 ae 92 88 44 03 22 27 9e a6 a6 a6 ae 92 88 44 03 22 45 67 89 00.
3. Deliver the frame: Transmit the malformed frame via any input channel that feeds into Dire Wolf's decode_aprs function — this includes RF (via a connected radio), APRS-IS network feed, or direct input to the decode_aprs utility.
4. Trigger assertion failure: When Dire Wolf processes the frame, aprs_mic_e() calls assert(strlen(mcomment) > 0), which evaluates to false, causing the process to abort immediately with a denial of service (GitHub Issue #618, Fix Commit 3658a87).

• Logs: Dire Wolf process logs showing abrupt termination with an assertion failure message such as decode_aprs: /path/to/src/decode_aprs.c:1672: aprs_mic_e: Assertion 'strlen(mcomment) > 0' failed; system logs (e.g., syslog, journald) recording unexpected process exits or SIGABRT signals for the direwolf or decode_aprs process.
• Process: Unexpected termination of the direwolf daemon or decode_aprs utility; repeated restarts of the Dire Wolf service if managed by a supervisor (e.g., systemd, supervisord).
• Network: Unusual AX.25 frames received on RF or APRS-IS containing MIC-E message type identifiers with embedded null bytes in the comment field; repeated identical malformed frames from the same source callsign or IP address.

The fix is available in commit 3658a87 of the Dire Wolf GitHub repository; users should update to any version of Dire Wolf built from or after this commit. As a temporary workaround, restrict access to APRS input channels where possible — for example, limit APRS-IS connections to trusted servers and restrict KISS TCP port access to trusted clients using firewall rules. Additionally, implementing network-level filtering to drop malformed APRS frames before they reach Dire Wolf, and monitoring for unexpected process terminations to enable rapid restart, can reduce operational impact until patching is complete (Fix Commit 3658a87, Red Hat Bugzilla).

Red Hat tracked the vulnerability via their security response process (Bugzilla bug 2424515) and assigned it high severity. The German Linux security site pro-linux.de covered the issue alongside a related Dire Wolf vulnerability. Community coverage appeared on platforms including Bluesky and various CVE aggregator sites shortly after disclosure. No significant vendor statements beyond the upstream fix commit and Red Hat tracking have been identified (Red Hat Bugzilla, Red Hat Advisory).