Multiple vulnerabilities in Mbed TLS



Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2024-45157
CVE-2024-45158
CVE-2024-45159
CWE-ID CWE-1059
CWE-121
CWE-287
Exploitation vector Network
Public exploit N/A
Vulnerable software
 mbed TLS
Universal components / Libraries / Libraries used by multiple products

Vendor ARM

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Insufficient Technical Documentation

EUVDB-ID: #VU96647

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-45157

CWE-ID: CWE-1059 - Insufficient Technical Documentation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error in product documentation. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and  MBEDTLS_CTR_DRBG_C are disabled.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

mbed TLS: 2.0.0 - 3.6.0

CPE2.3 External links

https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.28.9
https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-3.6.1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU96650

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-45158

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the mbedtls_ecdsa_der_to_raw() and
mbedtls_ecdsa_raw_to_der() functions when the bits parameter is larger than the
largest supported curve and PSA is disabled. A remote attacker can send specially crafted packets to the application, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

mbed TLS: 3.0.0 - 3.6.0

CPE2.3 External links

https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-3.6.1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authentication

EUVDB-ID: #VU96651

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45159

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to authenticate with a wrong certificate.

The vulnerability exists due to an error when a server enables optional authentication of the client and TLS 1.3 is used. if the client-provided certificate does not have appropriate values in keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and  MBEDTLS_X509_BADCERT_EXT_KEY_USAGE bits
clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication could be able to use it for TLS client authentication anyway.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

mbed TLS: 3.0.0 - 3.6.0

CPE2.3 External links

https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-3.6.1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###