Heap-Based Buffer Issues in Mbed TLS by Arm

CVE-2022-46393

Summary

A vulnerability in Mbed TLS prior to version 2.28.2 and 3.x prior to 3.3.0 allows for a potential heap-based buffer overflow and buffer over-read in DTLS. This occurs when the configuration option MBEDTLS_SSL_DTLS_CONNECTION_ID is active, and the parameters for connection ID length are improperly set, leading to potential exploitation in the application layer.

References