CVE-2025-69217: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-69217 is a weak pseudo-random number generator (PRNG) vulnerability in coturn, a free open-source TURN and STUN server implementation. Affecting versions 4.6.2r5 through 4.7.0-r4, the flaw was introduced by a code refactoring commit (88ced471) that replaced OpenSSL's RAND_bytes() with libc's random() function for nonce generation and port randomization. The vulnerability was publicly disclosed on December 30, 2025, and carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). The vulnerability was introduced in commit 88ced471, which renamed turn_random() in ns_turn_msg.c and provided a new implementation in apputils.c that uses libc's random() — a reversible Linear Congruential Generator (LCG) — instead of OpenSSL's RAND_bytes(). Because turn_random() is used for both nonce generation and relay port randomization, an attacker can send approximately 50 unauthenticated TURN Allocate requests to collect sequential nonces, then mathematically reconstruct the full internal state of the LCG, enabling prediction of future nonces and relay ports. Exploitation requires low privileges (valid TURN credentials) and no user interaction, and is achievable over the network (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker with knowledge of valid TURN credentials to predict authentication nonces, enabling IP spoofing and authentication bypass — they can send authenticated TURN messages without ever receiving server responses containing the nonce. Additionally, because relay port allocation is deterministic given the reconstructed PRNG seed, an attacker can predict future relay port assignments, enabling targeted relay hijacking, session spoofing, and tracking of relay service usage. The advisory also notes the potential for a loop attack as defined in RFC 5766, which can cause amplification in both packet size and count, directly impacting availability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing coturn TURN/STUN servers running versions 4.6.2r5 through 4.7.0-r4 using network scanning tools (e.g., Shodan, Censys) or by probing STUN/TURN ports (typically UDP/TCP 3478, 5349).
2. Obtain credentials: Acquire valid TURN credentials — in IoT deployments these are often static or shared across devices and may be discoverable through device firmware analysis or configuration files.
3. Collect sequential nonces: Send approximately 50 unauthenticated TURN Allocate requests to the server. Each failed authentication response will include a nonce value generated by the weak random() LCG.
4. Reconstruct PRNG state: Using the collected sequential nonces, mathematically reverse the LCG to fully reconstruct the current internal state of the random number generator and recover the original seed passed to srandom().
5. Predict future nonces: With the reconstructed PRNG state, compute the next nonce value the server will issue without needing to receive it from the server.
6. Forge authenticated requests: Craft TURN messages using the known credentials and the predicted nonce, sending them with a spoofed source IP address. The server will accept these as valid authenticated requests.
7. Predict relay ports: Using the same reconstructed PRNG seed, calculate the deterministic sequence of relay port allocations to identify or predict specific relay ports for targeted session hijacking or loop attacks (GitHub Advisory, Red Hat Bugzilla).

• Network: A burst of approximately 50 or more unauthenticated TURN Allocate requests (resulting in 401 Unauthorized responses) from a single source IP in rapid succession, which may indicate nonce harvesting activity.
• Network: TURN authenticated requests arriving from unexpected or spoofed source IP addresses that do not match the client's registered address.
• Network: Unusual patterns of relay port allocation requests, particularly sequential or predictable port usage, or allocation requests targeting specific port numbers.
• Logs: coturn server logs showing repeated 401 Unauthorized responses to Allocate requests followed immediately by a successful authenticated request from a different IP.
• Logs: High volume of TURN Allocate requests without corresponding data traffic, potentially indicating loop attack setup or relay port enumeration.
• Process/Behavior: Unexpected amplification of TURN relay traffic consistent with a loop attack as described in RFC 5766 (GitHub Advisory).

Upgrade coturn to a version newer than 4.7.0-r4 that includes the fix from commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9, which restores the use of OpenSSL's RAND_bytes() via turn_random_number() for all security-sensitive random number generation. Fedora and openSUSE have issued updated packages addressing this CVE. As interim mitigations: restrict TURN server access at the network level to trusted clients only; rotate TURN credentials, especially in IoT deployments where credentials may be widely shared; and monitor server logs for patterns of sequential unauthenticated allocation requests that may indicate exploitation attempts (GitHub Advisory, Red Hat, Red Hat Bugzilla).

The vulnerability was reported by researchers jornlp and vanhoefm (Mathy Vanhoef, known for Wi-Fi security research) and disclosed via GitHub Security Advisories on December 30, 2025. Red Hat assigned the bug a high severity rating and opened tracking in their Bugzilla system. Brief social media coverage appeared on Mastodon and Bluesky shortly after disclosure. Linux distribution security teams including Fedora and openSUSE issued updated packages. No major vendor statements beyond Red Hat's tracking have been identified (GitHub Advisory, Red Hat).