CVE-2025-66692

Executive Summary

CVE-2025-66692 is a security advisory affecting Binance's Trust Wallet Core library. The vulnerability is a buffer over-read located in the PublicKey::verify() method. An attacker can trigger a Denial of Service (DoS) by providing a crafted input that causes the method to read beyond the allocated memory buffer. This can lead to application crashes or unpredictable behavior. The vulnerability exists in versions prior to commit 5668c67. No public exploit code or proof-of-concept is currently available, and the CVSS score is listed as 0.0, indicating incomplete scoring data.

Supply Chain & Package Security

This vulnerability affects the Trust Wallet Core library, which is a critical component in the Binance ecosystem for handling cryptographic operations. As a library, it can be integrated into various applications, including mobile wallets and backend services. A DoS vulnerability in the PublicKey::verify() method could be exploited to disrupt services that rely on this library for signature verification, potentially impacting the availability of wallet applications or related infrastructure. Organizations using Trust Wallet Core should assess their exposure and prioritize patching.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which typically indicates that the scoring data is missing or incomplete. Based on the vulnerability description, a preliminary assessment suggests:

• Attack Vector (AV): Network (likely, as crafted input can be sent remotely)
• Attack Complexity (AC): Low (crafted input is straightforward)
• Privileges Required (PR): None (no authentication needed)
• User Interaction (UI): None (no user action required)
• Scope (S): Unchanged
• Confidentiality (C): None (no data leak)
• Integrity (I): None (no data modification)
• Availability (A): High (DoS impact)

Threat Level: Medium. While the impact is limited to availability, the lack of authentication and low complexity makes it exploitable. The absence of public exploits reduces immediate risk, but the vulnerability is unpatched in older versions.

Deep Dive & Mechanics

The PublicKey::verify() method is responsible for verifying digital signatures against a public key. A buffer over-read occurs when the method reads more data from a buffer than is actually allocated. In this case, a crafted input (likely a malformed signature or public key) can cause the method to access memory beyond the intended buffer boundaries.

Root Cause: The vulnerability stems from insufficient bounds checking on the input data. When processing the crafted input, the method does not validate the length of the data before reading, leading to an out-of-bounds read.

Impact: The over-read can cause the application to read arbitrary memory, potentially leading to a segmentation fault or other crash conditions, resulting in a Denial of Service. In some cases, it might also leak sensitive memory contents, but the primary impact is availability.

Vulnerable vs. Patched Code

The fix is implemented in commit 5668c67. The vulnerable code likely lacks proper length validation before reading the input buffer. The patched code adds checks to ensure that the input size is within the expected bounds before performing the read operation.

Vulnerable Code (Conceptual):

bool PublicKey::verify(const std::vector<uint8_t>& signature, const std::vector<uint8_t>& message) {
    // No length check on signature or message
    // Directly reads from signature buffer
    const uint8_t* sig_data = signature.data();
    // ... process sig_data without verifying size
}

Patched Code (Conceptual):

bool PublicKey::verify(const std::vector<uint8_t>& signature, const std::vector<uint8_t>& message) {
    // Added bounds check
    if (signature.size() < MIN_SIG_LENGTH || signature.size() > MAX_SIG_LENGTH) {
        return false; // or throw exception
    }
    const uint8_t* sig_data = signature.data();
    // ... process sig_data safely
}

Exploitation & Lab Setup

Red Team

Objective: Trigger a Denial of Service by sending a crafted input to the PublicKey::verify() method.

Lab Setup:

1. Environment: A Linux or macOS system with a vulnerable version of Trust Wallet Core (prior to commit 5668c67).
2. Dependencies: Install the library and its dependencies (e.g., OpenSSL, Boost).
3. Crafted Input: Create a malformed signature or public key that is shorter than expected, causing an over-read.

Exploit Code (Conceptual):

import socket

# Craft a malformed signature (too short)
malformed_signature = b'\x00' * 10  # Expected length might be 64 bytes

# Send to a service using the vulnerable library
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('target_ip', 8080))
sock.send(malformed_signature)
sock.close()

Execution:

1. Compile a test application that calls PublicKey::verify() with the crafted input.
2. Run the application and observe the crash (segmentation fault or abort).

Blue Team

Detection:

• Monitor for application crashes or unexpected terminations in services using Trust Wallet Core.
• Look for logs indicating failed signature verification attempts with malformed data.
• Use network monitoring to detect anomalous packets that are too short or malformed.

Mitigation:

• Immediately update to a version that includes commit 5668c67 or later.
• Implement input validation at the application level to reject malformed signatures before they reach the vulnerable method.
• Deploy Web Application Firewall (WAF) rules to block requests with suspiciously short or malformed cryptographic data.

Indicators of Compromise (IOCs)

• Application Crashes: Unexpected segmentation faults or abort signals in processes using Trust Wallet Core.
• Log Entries: Error messages related to signature verification failures, especially those involving buffer over-reads.
• Network Traffic: Packets containing malformed cryptographic data (e.g., signatures shorter than expected).

Detection Engineering

YARA Rule

rule CVE_2025_66692_Trust_Wallet_Core_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2025-66692 buffer over-read in Trust Wallet Core"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "PublicKey::verify" ascii wide nocase
        $s2 = "signature" ascii wide nocase
        $s3 = "buffer" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-66692 Trust Wallet Core DoS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit a buffer over-read in Trust Wallet Core's PublicKey::verify() method
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: trust_wallet_core
detection:
    selection:
        EventID: 1000  # Example: Application Error
        Message: "*PublicKey::verify*"
    condition: selection
falsepositives:
    - Legitimate use of malformed test data
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-66692 Trust Wallet Core DoS Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; byte_test:1,<,10,0; sid:1000001; rev:1;)

Note: This rule is a placeholder and should be tuned based on actual traffic patterns.

Remediation & Mitigation

1. Immediate Action: Update Trust Wallet Core to a version that includes commit 5668c67 or later.
2. Input Validation: Implement strict input validation on all cryptographic data (signatures, public keys) before processing.
3. Memory Safety: Use memory-safe languages or libraries that automatically handle bounds checking.
4. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Incident Response: Prepare a response plan for DoS attacks targeting cryptographic operations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert