An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-07-15T00:00:00

Updated: 2024-08-03T09:36:44.078Z

Reserved: 2022-07-08T00:00:00

Link: CVE-2022-35409

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-07-15T14:15:09.840

Modified: 2024-11-21T07:11:07.183

Link: CVE-2022-35409

cve-icon Redhat

No data.