Skip to main content

Stack-based Buffer Overflow

CVE-2024-45158

High
9.8/10

Summary

A Stack-based Buffer Overflow vulnerability was discovered in Mbed TLS, in "mbedtls_ecdsa_der_to_raw()" and "mbedtls_ecdsa_raw_to_der()" functions, that can occur when the "bits" parameter is larger than the largest supported "curve". In some configurations with PSA disabled, all values of "bits" are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.) This vulnerability affects mbedtls package version 3.6.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-121 - Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

Advisory Timeline

  • Published