CVE-2025-62875: 
NixOS vulnerability analysis and mitigation

CVE-2025-62875 is a local Denial-of-Service vulnerability in OpenSMTPD caused by an improper check for unusual or exceptional conditions (CWE-754). A world-writable UNIX domain socket (smtpd.sock, mode 0666) allows any unprivileged local user to crash the entire OpenSMTPD service by sending a malformed message. The vulnerability was introduced in OpenSMTPD 7.7.0 (specifically via commit 3270e23a6eb) and affects OpenSMTPD 7.7.0p0 across multiple distributions including Arch Linux, Debian 13, Fedora 42, Gentoo, OpenBSD 7.7, and NetBSD 10.1, as well as openSUSE Tumbleweed versions before 7.8.0p0-1.1. It was reported to upstream on 2025-09-15, disclosed publicly on 2025-10-31, and formally published on 2025-11-20. The CVSS v3.1 base score is 5.5 (Medium); the CVSS v4.0 base score is 6.9 (Medium) (OSS-Security, openSUSE Security).

The root cause is that the smtpd.sock UNIX domain socket is created with permissions 0666, making it writable by all local users. In mproc_dispatch(), the daemon calls fatal() — which terminates the entire smtpd: control process and cascades to shut down all smtpd services — whenever an error occurs reading from the socket (e.g., bad return from readv() in ibuf_read(), or an invalid message header length detected in imsg_parse_hdr()). This error handling was designed for trusted inter-daemon connections but was incorrectly applied to untrusted client connections as well. An attacker simply connects to /var/run/smtpd.sock and sends a message with an excessively large header length value to trigger the crash. A secondary, unpatched memory leak was also identified: repeated connection/disconnection cycles cause the smtpd: control process to leak approximately 100 MB of memory per 30 minutes, enabling a slower local DoS even after the primary fix is applied (OSS-Security, openSUSE Security).

Successful exploitation causes an immediate crash of the entire OpenSMTPD service, resulting in complete disruption of email delivery on the affected host. The attack has no impact on confidentiality or integrity — only availability is affected. Because the crash terminates all smtpd daemon processes simultaneously, recovery requires manual service restart, and any in-flight mail processing at the time of the crash may be lost or delayed (OSS-Security, openSUSE Security).

A proof-of-concept Python script (talk_smtpd.py) was published alongside the disclosure, demonstrating that a single malformed connection to /var/run/smtpd.sock is sufficient to crash the service. The exploit requires only local access with low privileges and no user interaction. The EPSS score is approximately 0.013% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. No threat actor attribution has been identified (OSS-Security, openSUSE Security).

1. Reconnaissance: Confirm the target system is running OpenSMTPD 7.7.0p0 and that /var/run/smtpd.sock exists with world-writable permissions (ls -la /var/run/smtpd.sock should show mode 0666).
2. Obtain local access: The attacker must have a local shell on the target system with any non-root user account (no special privileges required).
3. Craft malformed message: Using the published Python PoC (talk_smtpd.py), connect to /var/run/smtpd.sock via a UNIX domain socket and send a message with an excessively large header length value that violates the expected format parsed by imsg_parse_hdr().
4. Trigger crash: The smtpd: control daemon receives the malformed message, detects the invalid header length, and calls fatal(), immediately terminating itself and cascading a shutdown of all smtpd daemon processes.
5. Result: All OpenSMTPD services are stopped, causing a complete email service outage until an administrator manually restarts the daemon (OSS-Security, openSUSE Security).

• Logs: Sudden appearance of fatal() error messages in the smtpd system log (e.g., syslog/journald) with no preceding SMTP protocol errors; all smtpd processes exiting simultaneously without a graceful shutdown signal.
• Process: All smtpd: child processes (control, lookup, queue, etc.) disappearing from the process list at the same time without an administrator-initiated stop.
• Network/Socket: Unexpected connections to /var/run/smtpd.sock from non-smtpctl processes or from unprivileged user accounts visible in socket audit logs (e.g., via auditd or strace).
• File System: Presence of the talk_smtpd.py PoC script or similar Python scripts in user home directories or /tmp; repeated connection artifacts in socket-level audit trails (OSS-Security).

The primary fix is to upgrade OpenSMTPD to version 7.8.0p0 (upstream bugfix commit 653abf00f5283a2d3247eb9aabf8987d1b2f0510), or on openSUSE Tumbleweed, to package version 7.8.0p0-1.1 or later. As a temporary workaround, administrators who do not require non-root users to enqueue mail via the sendmail interface can apply a permissions-tightening patch to restrict access to smtpd.sock (reducing it from 0666 to a more restrictive mode), though this will break the non-root mail enqueue use case. Note that a secondary memory leak issue in socket connection cleanup remains unaddressed in 7.8.0 and can still be used for a slower local DoS; restricting socket permissions also mitigates this secondary issue (OSS-Security, openSUSE Security, SUSE Bugzilla).

The vulnerability was discovered and reported by Matthias Gerstner of the SUSE Linux Security Team during a code review prompted by packaging OpenSMTPD for openSUSE Tumbleweed. The disclosure process was complicated by a lack of timely response from upstream OpenSMTPD developers, with the report going unacknowledged for over six weeks before contact was finally established two days before the embargo deadline. The openSUSE security team published a detailed blog post and coordinated with the oss-security mailing list and the distros list. The OpenSMTPD upstream team acknowledged the issue and published a fix on 2025-10-31, the same day as public disclosure (OSS-Security, openSUSE Security).