Double Free Vulnerability in Mbed TLS
Summary
CVE-2021-44732: Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. Affects mbedtls across 5 version ranges.
< 2.16.12-r0
>= 3f8d78411a26e833db18d9fbde0e2f0baeda87f0, < 8b3f26a5ac38d4fdccbc5c5366229f3e01dafcc0
< 8b3f26a5ac38d4fdccbc5c5366229f3e01dafcc0
< cf4667126010c665341f9e50ef691b7ef8294188
< d65aeb37349ad1a50e0f6c9b694d4b5290d60e49
Fixed in 2.16.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mbed TLS is an open-source cryptographic library that provides secure communication protocols, such as SSL/TLS, for embedded systems. It is widely used in various applications, including IoT devices and network communication. The library is designed to be portable, efficient, and easy to use. However, a double free vulnerability has been discovered in Mbed TLS versions before 3.0.1.
Vulnerability Detail
The double free vulnerability in Mbed TLS occurs in certain out-of-memory conditions when the mbedtls_ssl_set_session() function fails. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code. The double free vulnerability arises when the same memory address is freed twice, leading to memory corruption and potential security issues.
How To Fix
Minimum fixed version
2.16.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade mbedtlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the patched version of Mbed TLS.
Conclusion
The double free vulnerability in Mbed TLS can lead to a denial-of-service condition or potential code execution. It is crucial to upgrade to the fixed version of Mbed TLS (3.0.1 or later) to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mbedtls →
FAQ
Mbed TLS is an open-source cryptographic library used for implementing secure communication protocols, such as SSL/TLS, in embedded systems.
A double free vulnerability occurs when the same memory address is freed twice, leading to memory corruption and potential security issues.
This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code.
To fix this vulnerability, it is recommended to upgrade to Mbed TLS version 3.0.1 or later.
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the patched version of Mbed TLS.
Related vulnerabilities
Recent vulnerabilities recorded for mbedtls.
