CVE-2025-62672: rplay DoS Vulnerability via rplay_unpack

CVE-2025-62672 Overview

CVE-2025-62672 affects rplay through version 3.3.2, a network audio playback service historically deployed on Unix and Linux systems. The vulnerability resides in the rplay_unpack function within librplay/rplay.c, specifically in the memcpy call handling the RPLAY_DATA case. Attackers can send crafted network packets without authentication to trigger a SIGSEGV and crash the rplay daemon. The advisory also notes the possibility of unspecified additional impact beyond the denial of service outcome. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling) and is exploitable remotely over the network.

Critical Impact

Unauthenticated remote attackers can crash the rplay daemon by sending malformed packet data, resulting in service disruption for any host running vulnerable rplay versions.

Affected Products

• rplay versions through 3.3.2
• librplay shared library used by rplay clients and daemons
• Debian and derivative distributions packaging rplay from the Debian Salsa rplay repository

Discovery Timeline

• 2025-10-18 - Vulnerability discussed publicly on the OpenWall OSS-Security list
• 2025-10-19 - CVE-2025-62672 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62672

Vulnerability Analysis

The defect lives in rplay_unpack in librplay/rplay.c. When the function processes an incoming packet tagged as RPLAY_DATA, it invokes memcpy using length or offset values derived from attacker-controlled packet fields. The function does not properly validate these values against the actual size of the destination buffer or the received packet. As a result, memcpy reads or writes memory outside the intended bounds, causing the daemon process to receive a segmentation fault signal (SIGSEGV) and terminate. The NVD entry additionally notes possible unspecified impact, which reflects the ambiguity typical of memory corruption bugs where controlled overwrites could conceivably affect integrity beyond a crash.

Root Cause

The root cause is missing input validation on packet length and offset fields before performing a memcpy in the RPLAY_DATA handling path. The code assumes fields supplied by the peer describe a valid buffer copy operation. No authentication is required to reach this code path, so any host able to send UDP or TCP packets to the rplay listener can trigger the fault.

Attack Vector

Attack requires only network reachability to the rplay service port. The attacker crafts a packet containing a RPLAY_DATA opcode with length or offset values that violate buffer boundaries. Sending this packet causes rplay_unpack to invoke memcpy with unsafe parameters and the daemon crashes. Repeated packets keep the service down until an operator restarts it or applies a patch. No user interaction, privileges, or prior session state are required.

Detection Methods for CVE-2025-62672

Indicators of Compromise

• Unexpected termination of the rplay daemon process with SIGSEGV entries in dmesg or /var/log/syslog
• Core dumps referencing rplay_unpack or librplay.so in stack traces
• Inbound packets to the rplay listener port from unexpected external sources

Detection Strategies

• Monitor process supervision logs (systemd, init.d) for repeated rplay daemon restarts within short intervals
• Inspect network flow records for unsolicited traffic targeting hosts running rplay, particularly from untrusted networks
• Enable core dump collection on rplay hosts and alert when new dumps appear in the configured core_pattern path

Monitoring Recommendations

• Forward rplay daemon exit codes and signal information to a centralized log platform for correlation
• Track outbound egress from the rplay host after a crash to identify follow-on activity if unspecified impact is realized
• Baseline expected rplay client sources and alert on packets from IPs outside that baseline

How to Mitigate CVE-2025-62672

Immediate Actions Required

• Restrict network access to the rplay listener using host or perimeter firewalls, allowing only trusted client hosts
• Stop and disable the rplay daemon on systems that do not require the service until a fixed package is available
• Track the Debian Salsa rplay repository for patched releases and rebuild downstream packages accordingly

Patch Information

At the time of NVD publication no vendor patch identifier is listed. Distribution maintainers, including the Debian package maintainer referenced in the Debian Salsa rplay repository, are the primary source for corrected builds. Administrators should monitor distribution security trackers and the OpenWall OSS-Security thread for patch announcements referencing rplay_unpack and the RPLAY_DATA case.

Workarounds

• Block inbound traffic to the rplay service port at the network edge and on local iptables or nftables rulesets
• Bind the rplay daemon to 127.0.0.1 where feasible to eliminate remote exposure
• Replace rplay with maintained audio streaming alternatives on production systems given the project's limited upstream activity

# Configuration example: restrict rplay to loopback and drop remote traffic
sudo systemctl stop rplay
sudo iptables -A INPUT -p udp --dport 5555 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 5555 -j DROP
sudo iptables -A INPUT -p tcp --dport 5555 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5555 -j DROP