Stack-based Buffer Overflow Affecting armmbed/mbedtls package, versions [,3.6.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-ARMMBEDMBEDTLS-7919065
- published 6 Sep 2024
- disclosed 5 Sep 2024
- credit Unknown
Introduced: 5 Sep 2024
CVE-2024-45158 Open this link in a new tabHow to fix?
Upgrade armmbed/mbedtls to version 3.6.1 or higher.
Overview
Affected versions of this package are vulnerable to Stack-based Buffer Overflow through the mbedtls_ecdsa_der_to_raw and mbedtls_ecdsa_raw_to_der functions. An attacker can execute arbitrary code or cause a denial of service by providing a bits parameter value that exceeds the size of the largest supported curve.
Notes:
This is only exploitable if PSA (Platform Security Architecture) is disabled;
To provoke the attack, the attacker needs to control the declared curve bit-size, not just the buffer size and content.
Workaround
This can be mitigated if MBEDTLS_PSA_CRYPTO_C is enabled and the calling code first ensures that the bits parameter is the bit-size of a curve that is supported in the build of Mbed TLS.