CVE-2025-70954

Executive Summary

CVE-2025-70954 is a critical Null Pointer Dereference vulnerability in the TON Virtual Machine (TVM) within the TON Blockchain, affecting versions prior to v2025.06. The flaw resides in the execution logic of the INMSGPARAM instruction, where the program fails to validate a pointer before dereferencing it. An attacker can exploit this by sending a malicious transaction or deploying a crafted smart contract, causing a segmentation fault in validator nodes. This leads to a Denial of Service (DoS) that can disrupt the entire blockchain network's availability.

The vulnerability has a CVSS score of 0.0 (likely uncalculated or placeholder), but based on the impact, it is assessed as High severity with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No public proof-of-concept (PoC) or exploit code is available, and no patch has been officially released. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk remains significant for TON infrastructure.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the TON Blockchain node software, which is typically deployed as a compiled binary or container image. Organizations should verify the integrity of their TON node installations and ensure they are not running vulnerable versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; a malicious transaction or smart contract suffices.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability for the validator node.

Threat Level: High. The vulnerability can crash validator nodes, leading to network-wide DoS. While no active exploitation is reported, the potential for disruption is significant.

Deep Dive & Mechanics

The TON Virtual Machine (TVM) executes smart contracts and processes transactions. The INMSGPARAM instruction is used to parse incoming message parameters. The vulnerability occurs because the TVM does not check if a pointer to a message parameter is null before accessing it. When a specially crafted transaction or smart contract is submitted, it can cause the pointer to be null, leading to a null pointer dereference.

In C/C++ (the likely implementation language), dereferencing a null pointer results in undefined behavior, typically a segmentation fault. This crashes the validator node process, causing it to stop processing blocks and transactions. Since validators are critical for consensus, a crash can halt block production and disrupt the entire network.

The attack vector is simple: an attacker sends a malicious transaction or deploys a smart contract that triggers the vulnerable code path. No special privileges are required, and the attack can be automated.

Vulnerable vs. Patched Code

The vulnerable code likely looks like this (pseudocode):

// Vulnerable version (pre-v2025.06)
void execute_INMSGPARAM(Message *msg) {
    Param *param = get_param(msg, index);
    // No null check
    process_param(param->value); // Null pointer dereference if param is NULL
}

The patched version should include a null check:

// Patched version (v2025.06 and later)
void execute_INMSGPARAM(Message *msg) {
    Param *param = get_param(msg, index);
    if (param == NULL) {
        // Handle error gracefully
        return;
    }
    process_param(param->value);
}

The exact patch details are unknown, but the fix involves adding a null pointer validation before dereferencing.

Exploitation & Lab Setup

Red Team

Objective: Crash a TON validator node to cause a DoS.

Prerequisites:

• Access to the TON network (mainnet or testnet).
• Ability to send transactions or deploy smart contracts.

Steps:

1. Craft a malicious transaction that triggers the INMSGPARAM instruction with a null pointer. This can be done by manipulating message parameters to be missing or malformed.
2. Submit the transaction to the network.
3. The validator node processing the transaction will crash due to a segmentation fault.
4. Repeat to crash multiple validators, potentially disrupting consensus.

Note: No public exploit code is available. The following is a conceptual example:

# Conceptual exploit (not functional)
import ton_client

def exploit():
    # Create a malicious transaction with missing parameters
    tx = {
        "source": "attacker_address",
        "destination": "victim_contract",
        "body": b"\x00" * 100,  # Malformed body
        "init_code": b"",
        "data": b""
    }
    # Send transaction
    ton_client.send_transaction(tx)

Blue Team

Detection:

• Monitor validator logs for segmentation faults or crashes.
• Use network monitoring to detect anomalous transactions with malformed parameters.
• Implement rate limiting for transactions from unknown sources.

Mitigation:

• Immediately upgrade to TON v2025.06 or later once a patch is available.
• If patching is not possible, consider deploying a Web Application Firewall (WAF) or proxy to filter suspicious transactions.
• Isolate validator nodes from direct public access where possible.

Indicators of Compromise (IOCs)

• Log Entries: Segmentation fault errors in validator logs, e.g., "Segmentation fault (core dumped)" or "SIGSEGV".
• Network Traffic: Transactions with malformed message parameters, especially those targeting the INMSGPARAM instruction.
• Process Behavior: Validator process crashes unexpectedly, leading to downtime.

File Hashes (if available):

• No specific hashes are available for malicious payloads.

Detection Engineering

YARA Rule

rule CVE_2025_70954_TON_Null_Pointer_Dereference {
    meta:
        description = "Detects potential exploitation of CVE-2025-70954 in TON Blockchain"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-70954"
    strings:
        $s1 = "INMSGPARAM" ascii wide nocase
        $s2 = "null pointer" ascii wide nocase
        $s3 = "segmentation fault" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: TON Validator Crash Due to Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects segmentation faults in TON validator logs indicating CVE-2025-70954 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "Segmentation fault"
        - "SIGSEGV"
        - "core dumped"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-70954 TON Null Pointer Dereference Attempt"; flow:to_server; content:"INMSGPARAM"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade TON node software to v2025.06 or later once a patch is released. Monitor official TON channels for updates.
2. Workaround: If patching is delayed, implement network-level filtering to block suspicious transactions. Use a proxy to validate message parameters before forwarding to validators.
3. Monitoring: Enable detailed logging on validator nodes and set up alerts for segmentation faults or crashes.
4. Incident Response: Have a plan to quickly restart crashed validators and investigate the source of malicious transactions.
5. Long-term: Conduct code audits of TVM instruction handlers to prevent similar null pointer dereference vulnerabilities.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.