mbed TLS up to 2.28.1/3.1.x ClientHello Message heap-based overflow

Summaryinfo

A vulnerability was found in mbed TLS up to 2.28.1/3.1.x and classified as critical. Affected by this vulnerability is an unknown functionality of the component ClientHello Message Handler. Such manipulation leads to heap-based overflow. This vulnerability is traded as CVE-2022-35409. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in mbed TLS up to 2.28.1/3.1.x. It has been rated as critical. Affected by this issue is an unknown code of the component ClientHello Message Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.

The weakness was shared 07/16/2022. The advisory is shared for download at mbed-tls.readthedocs.io. This vulnerability is handled as CVE-2022-35409 since 07/08/2022. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.28.2 or 3.2.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• mbed TLS

Version

• 2.28.0
• 2.28.1
• 3.0
• 3.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion