Vulnerabilities > CVE-2022-46393 - Out-of-bounds Write vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

arm

fedoraproject

CWE-787

critical

NVD

Published: 2022-12-15

Updated: 2023-11-07

Summary

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.

Vulnerable Configurations

Part	Description	Count
Application	Arm ARM Mbed TLS - ARM Mbed TLS 1.3.0 ARM Mbed TLS 1.3.1 ARM Mbed TLS 1.3.2 ARM Mbed TLS 1.3.3 ARM Mbed TLS 1.3.4 ARM Mbed TLS 1.3.5 ARM Mbed TLS 1.3.6 ARM Mbed TLS 1.3.7 ARM Mbed TLS 1.3.8 ARM Mbed TLS 1.3.9 ARM Mbed TLS 1.3.10 ARM Mbed TLS 1.3.11 ARM Mbed TLS 1.3.12 ARM Mbed TLS 1.3.13 ARM Mbed TLS 1.3.14 ARM Mbed TLS 1.3.15 ARM Mbed TLS 1.3.16 ARM Mbed TLS 1.3.17 ARM Mbed TLS 1.3.18 ARM Mbed TLS 1.3.19 ARM Mbed TLS 1.3.20 ARM Mbed TLS 1.3.21 ARM Mbed TLS 1.3.22 ARM Mbed TLS 2.0.0 ARM Mbed TLS 2.1.0 ARM Mbed TLS 2.1.1 ARM Mbed TLS 2.1.2 ARM Mbed TLS 2.1.3 ARM Mbed TLS 2.1.4 ARM Mbed TLS 2.1.5 ARM Mbed TLS 2.1.6 ARM Mbed TLS 2.1.7 ARM Mbed TLS 2.1.8 ARM Mbed TLS 2.1.9 ARM Mbed TLS 2.1.10 ARM Mbed TLS 2.1.11 ARM Mbed TLS 2.1.12 ARM Mbed TLS 2.1.13 ARM Mbed TLS 2.1.14 ARM Mbed TLS 2.1.15 ARM Mbed TLS 2.1.16 ARM Mbed TLS 2.1.17 ARM Mbed TLS 2.1.18 ARM Mbed TLS 2.2.0 ARM Mbed TLS 2.2.1 ARM Mbed TLS 2.2.2 ARM Mbed TLS 2.2.3 ARM Mbed TLS 2.3.0 ARM Mbed TLS 2.3.1 ARM Mbed TLS 2.3.2 ARM Mbed TLS 2.4.0 ARM Mbed TLS 2.4.1 ARM Mbed TLS 2.4.2 ARM Mbed TLS 2.5.0 ARM Mbed TLS 2.5.1 ARM Mbed TLS 2.6.0 ARM Mbed TLS 2.6.1 ARM Mbed TLS 2.7.0 ARM Mbed TLS 2.7.1 ARM Mbed TLS 2.7.2 ARM Mbed TLS 2.7.3 ARM Mbed TLS 2.7.4 ARM Mbed TLS 2.7.5 ARM Mbed TLS 2.7.6 ARM Mbed TLS 2.7.7 ARM Mbed TLS 2.7.8 ARM Mbed TLS 2.7.9 ARM Mbed TLS 2.7.10 ARM Mbed TLS 2.7.11 ARM Mbed TLS 2.7.12 ARM Mbed TLS 2.7.13 ARM Mbed TLS 2.7.14 ARM Mbed TLS 2.7.15 ARM Mbed TLS 2.7.16 ARM Mbed TLS 2.7.17 ARM Mbed TLS 2.7.18 ARM Mbed TLS 2.8.0 ARM Mbed TLS 2.9.0 ARM Mbed TLS 2.10.0 ARM Mbed TLS 2.11.0 ARM Mbed TLS 2.12.0 ARM Mbed TLS 2.13.0 ARM Mbed TLS 2.13.1 ARM Mbed TLS 2.14.0 ARM Mbed TLS 2.14.1 ARM Mbed TLS 2.15.0 ARM Mbed TLS 2.15.1 ARM Mbed TLS 2.16.0 ARM Mbed TLS 2.16.1 ARM Mbed TLS 2.16.2 ARM Mbed TLS 2.16.3 ARM Mbed TLS 2.16.4 ARM Mbed TLS 2.16.5 ARM Mbed TLS 2.16.6 ARM Mbed TLS 2.16.7 ARM Mbed TLS 2.16.8 ARM Mbed TLS 2.16.9 ARM Mbed TLS 2.16.10 ARM Mbed TLS 2.16.11 ARM Mbed TLS 2.16.12 ARM Mbed TLS 2.17.0 ARM Mbed TLS 2.18.0 ARM Mbed TLS 2.18.1 ARM Mbed TLS 2.19.0 ARM Mbed TLS 2.19.1 ARM Mbed TLS 2.20.0 ARM Mbed TLS 2.21.0 ARM Mbed TLS 2.22.0 ARM Mbed TLS 2.23.0 ARM Mbed TLS 2.24.0 ARM Mbed TLS 2.25.0 ARM Mbed TLS 2.26.0 ARM Mbed TLS 2.27.0 ARM Mbed TLS 2.28.0 ARM Mbed TLS 2.28.1 ARM Mbed TLS 3.0.0 ARM Mbed TLS 3.1.0 ARM Mbed TLS 3.2.0	154
OS	Fedoraproject Fedoraproject Fedora 36 Fedoraproject Fedora 37	2

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References