// CVE · Published · NVD
Insufficient protection of serialized SSL session/context data can lead to memory-safety issues when restoring tampered or corrupted state. Credited jointly with Haruto Kimura (Stella).
Mbed TLS can serialize a TLS session or a whole SSL context to a buffer and restore it later. The library treated that buffer as trusted: a restored structure that had been modified or corrupted was processed without the consistency checks that protect the same fields on the wire, so deserialization could read and write out of bounds.
Anyone who can modify serialized session or context data can corrupt memory in the process that restores it, up to arbitrary code execution. NVD scores it 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The Mbed TLS advisory keeps the API and makes the requirement explicit: serialized data has to be stored where an attacker cannot reach it, or protected with authenticated encryption and validated before it is restored.
Reported by Haruto Kimura (Stella) and Eva Crystal (0xiviel), XSource Security.
Integer underflow of mlen in crypto_sign_open() in the CROSS reference implementation leads to a heap buffer overflow during signature verification.
FFDH key exchange lacks contributory-behaviour / peer-key validation, enabling protocol-level abuse. Found independently by Eva Crystal (0xiviel).
Out-of-bounds read in mbedtls_ccm_finish(): an oversized tag_len in the multipart CCM API exposes adjacent CCM context data. Discovered through the Intigriti Trusted Firmware program.
Possible buffer overflow in mbedtls_ecdh_calc_secret() when the output buffer is too small - up to remote code execution.
