CVE-2021-44732

What it actually does

Double free in mbedtls_ssl_set_session under specific out-of-memory conditions leading to heap corruption or process crash.

Why it matters to the business

Remote attackers could crash or potentially take over services using the library, causing outages or unauthorized access with moderate urgency due to low EPSS and no known ransomware use after nearly five years.

How an attack unfolds

An attacker initiates an SSL/TLS connection and forces an out-of-memory scenario during session handling in mbedtls_ssl_set_session, triggering the double free to corrupt memory and achieve code execution or denial of service.

How to fix it

Upgrade Mbed TLS to 3.0.1 or later (GIT commit 8b3f26a5ac38d4fdccbc5c5366229f3e01dafcc0); for Debian tiff packages on versions 11/12/13 upgrade to 3.7.2-3.

How to confirm the fix worked

Verify installed version against fixed releases or commit hashes; test mbedtls_ssl_set_session under simulated OOM conditions to confirm absence of double free.

Typical attack path

1. Establish TLS connection to target service
2. Trigger memory pressure to induce OOM during mbedtls_ssl_set_session
3. Trigger double free to corrupt heap structures
4. Leverage corruption for arbitrary code execution or crash

How to detect it

Review application and system logs for repeated mbedtls_ssl_set_session failures accompanied by out-of-memory or heap corruption indicators; inspect crash dumps for double-free signatures in TLS session code paths.

What your security team should do

• Apply updates to Mbed TLS 3.0.1+ or Debian tiff 3.7.2-3 immediately on all affected systems
• Scan dependency trees for embedded mbedtls copies and rebuild where needed
• Monitor EPSS trend and exploit availability for any increase in activity