// CVE · Published · Mbed TLS
Possible buffer overflow in mbedtls_ecdh_calc_secret() when the output buffer is too small - up to remote code execution.
mbedtls_ecdh_calc_secret() checks that the output buffer is large enough for the shared secret, but the check was computed from the secret’s significant bytes. When the most significant bytes of the secret happened to be zero the check passed for a buffer that was too small, while the function still wrote the full width of the curve. Instead of returning an error it wrote past the end of the caller’s buffer.
A stack or heap overflow that fires probabilistically, on secrets with leading zero bytes, in code that passes an undersized buffer. The Mbed TLS advisory rates it Medium and puts the consequence anywhere from a crash to arbitrary code execution, depending on what sits after the buffer.
Reported by Eva Crystal (0xiviel), founder of XSource Security, as credited in the advisory.
Integer underflow of mlen in crypto_sign_open() in the CROSS reference implementation leads to a heap buffer overflow during signature verification.
Insufficient protection of serialized SSL session/context data can lead to memory-safety issues when restoring tampered or corrupted state. Credited jointly with Haruto Kimura (Stella).
FFDH key exchange lacks contributory-behaviour / peer-key validation, enabling protocol-level abuse. Found independently by Eva Crystal (0xiviel).
Out-of-bounds read in mbedtls_ccm_finish(): an oversized tag_len in the multipart CCM API exposes adjacent CCM context data. Discovered through the Intigriti Trusted Firmware program.
