Buffer Over-Read Vulnerability in wolfSSL Product

CVE-2022-42905

Summary

In wolfSSL versions earlier than 5.5.2, the use of callback functions (enabled by the WOLFSSL_CALLBACKS flag) poses a risk. A threat actor, acting as a malicious TLS 1.3 client or a network adversary, can exploit this vulnerability to cause a buffer over-read on the heap, resulting in the disclosure of potentially sensitive data. This vulnerability primarily impacts systems that utilize the WOLFSSL_CALLBACKS option, which is primarily intended for debugging purposes, and should be used with caution.

References