Critical Integer Overflow Vulnerability in mbedtls Package
Summary
ALPINE-CVE-2017-18187: In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c. Affects mbedtls versions < 2.7.0-r0. Fixed in 2.7.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mbedtls is a popular open-source cryptographic library that provides a range of cryptographic protocols and tools for secure communication. It is widely used in embedded systems and IoT devices due to its lightweight design and ease of integration. However, a critical vulnerability has been identified in versions prior to 2.7.0, which could potentially expose systems to severe security risks.
Vulnerability Detail
In ARM mbed TLS before version 2.7.0, there exists a bounds-check bypass vulnerability caused by an integer overflow in the PSK identity parsing function (ssl_parse_client_psk_identity) located in library/ssl_srv.c. This flaw allows attackers to exploit the parsing mechanism, potentially leading to unauthorized access or manipulation of sensitive data. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the urgency for remediation.
How To Fix
Minimum fixed version
2.7.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade mbedtlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict input validation and monitoring for unusual behavior in your application to mitigate potential exploitation of this vulnerability.
Conclusion
The integer overflow vulnerability in the mbedtls package poses a significant risk to systems using versions prior to 2.7.0. It is crucial to update to the patched version to safeguard against potential exploits. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mbedtls →
FAQ
The vulnerability is an integer overflow that allows for bounds-check bypass during PSK identity parsing, which could lead to unauthorized access.
Exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive data or manipulate secure communications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement strict input validation and monitor your application for any unusual behavior as a temporary measure.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mbedtls.
