Vulnerabilities > CVE-2020-36475 - Incorrect Calculation of Buffer Size vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

NVD

Published: 2021-08-23

Updated: 2024-11-21

Summary

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.

Vulnerable Configurations

Part	Description	Count
Application	Arm ARM Mbed TLS 2.17.0 ARM Mbed TLS 2.18.0 ARM Mbed TLS 2.18.1 ARM Mbed TLS 2.19.0 ARM Mbed TLS 2.19.1 ARM Mbed TLS 2.20.0 ARM Mbed TLS 2.21.0 ARM Mbed TLS 2.22.0 ARM Mbed TLS 2.23.0 ARM Mbed TLS 2.24.0 ARM Mbed TLS 2.8.0 ARM Mbed TLS 2.9.0 ARM Mbed TLS 2.10.0 ARM Mbed TLS 2.11.0 ARM Mbed TLS 2.12.0 ARM Mbed TLS 2.13.0 ARM Mbed TLS 2.13.1 ARM Mbed TLS 2.14.0 ARM Mbed TLS 2.14.1 ARM Mbed TLS 2.15.0 ARM Mbed TLS 2.15.1 ARM Mbed TLS 2.16.0 ARM Mbed TLS 2.16.1 ARM Mbed TLS 2.16.2 ARM Mbed TLS 2.16.3 ARM Mbed TLS 2.16.4 ARM Mbed TLS 2.16.5 ARM Mbed TLS 2.16.6 ARM Mbed TLS 2.16.7 ARM Mbed TLS 2.16.8 ARM Mbed TLS - ARM Mbed TLS 1.3.0 ARM Mbed TLS 1.3.1 ARM Mbed TLS 1.3.2 ARM Mbed TLS 1.3.3 ARM Mbed TLS 1.3.4 ARM Mbed TLS 1.3.5 ARM Mbed TLS 1.3.6 ARM Mbed TLS 1.3.7 ARM Mbed TLS 1.3.8 ARM Mbed TLS 1.3.9 ARM Mbed TLS 1.3.10 ARM Mbed TLS 1.3.11 ARM Mbed TLS 1.3.12 ARM Mbed TLS 1.3.13 ARM Mbed TLS 1.3.14 ARM Mbed TLS 1.3.15 ARM Mbed TLS 1.3.16 ARM Mbed TLS 1.3.17 ARM Mbed TLS 1.3.18 ARM Mbed TLS 1.3.19 ARM Mbed TLS 1.3.20 ARM Mbed TLS 1.3.21 ARM Mbed TLS 1.3.22 ARM Mbed TLS 2.0.0 ARM Mbed TLS 2.1.0 ARM Mbed TLS 2.1.1 ARM Mbed TLS 2.1.2 ARM Mbed TLS 2.1.3 ARM Mbed TLS 2.1.4 ARM Mbed TLS 2.1.5 ARM Mbed TLS 2.1.6 ARM Mbed TLS 2.1.7 ARM Mbed TLS 2.1.8 ARM Mbed TLS 2.1.9 ARM Mbed TLS 2.1.10 ARM Mbed TLS 2.1.11 ARM Mbed TLS 2.1.12 ARM Mbed TLS 2.1.13 ARM Mbed TLS 2.1.14 ARM Mbed TLS 2.1.15 ARM Mbed TLS 2.1.16 ARM Mbed TLS 2.1.17 ARM Mbed TLS 2.1.18 ARM Mbed TLS 2.2.0 ARM Mbed TLS 2.2.1 ARM Mbed TLS 2.2.2 ARM Mbed TLS 2.2.3 ARM Mbed TLS 2.3.0 ARM Mbed TLS 2.3.1 ARM Mbed TLS 2.3.2 ARM Mbed TLS 2.4.0 ARM Mbed TLS 2.4.1 ARM Mbed TLS 2.4.2 ARM Mbed TLS 2.5.0 ARM Mbed TLS 2.5.1 ARM Mbed TLS 2.6.0 ARM Mbed TLS 2.6.1 ARM Mbed TLS 2.7.0 ARM Mbed TLS 2.7.1 ARM Mbed TLS 2.7.2 ARM Mbed TLS 2.7.3 ARM Mbed TLS 2.7.4 ARM Mbed TLS 2.7.5 ARM Mbed TLS 2.7.6 ARM Mbed TLS 2.7.7 ARM Mbed TLS 2.7.8 ARM Mbed TLS 2.7.9 ARM Mbed TLS 2.7.10 ARM Mbed TLS 2.7.11 ARM Mbed TLS 2.7.12 ARM Mbed TLS 2.7.13 ARM Mbed TLS 2.7.14 ARM Mbed TLS 2.7.15 ARM Mbed TLS 2.7.16 ARM Mbed TLS 2.7.17	140
OS	Siemens Siemens Logo! Cmr2020 Firmware * Siemens Logo! Cmr2040 Firmware * Siemens Simatic Rtu3031C Firmware * Siemens Simatic Rtu3041C Firmware * Siemens Simatic Rtu3030C Firmware * Siemens Simatic Rtu3000C Firmware *	6
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2
Hardware	Siemens Siemens Logo! Cmr2020 - Siemens Logo! Cmr2040 - Siemens Simatic Rtu3031C - Siemens Simatic Rtu3041C - Siemens Simatic Rtu3030C - Siemens Simatic Rtu3000C -	6

Common Weakness Enumeration (CWE)

CWE-131 - Incorrect Calculation of Buffer Size

Common Attack Pattern Enumeration and Classification (CAPEC)

Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
Buffer Overflow via Parameter Expansion
In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References