Buffer Overflow Vulnerability in wolfSSL During TLS 1.3 Handshake

CVE-2022-39173

What is CVE-2022-39173?

In wolfSSL versions before 5.5.1, a buffer overflow vulnerability exists during the TLS 1.3 handshake process. Malicious clients can exploit this vulnerability by initiating a session resume that involves sending two Client Hello messages, one in response to a Hello Retry Request and another to re-establish a previous session. Both messages must include duplicate cipher suites to trigger the buffer overflow, making systems utilizing affected versions susceptible to potential exploitation during secure communications.

References