CVE-2022-35409

What it actually does

Heap-based buffer over-read of up to 255 bytes in DTLS ClientHello processing when MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE is enabled and MBEDTLS_SSL_IN_CONTENT_LEN is below the configuration threshold, leading to server crash or information disclosure through error responses.

Why it matters to the business

DTLS servers using affected Mbed TLS versions may experience unexpected downtime or leakage of limited memory contents; prevalence in embedded and media processing ecosystems increases exposure surface for services relying on these libraries, though low EPSS and lack of KEV listing indicate limited active exploitation risk 1556 days post-publication.

How an attack unfolds

An unauthenticated attacker sends a specially crafted invalid ClientHello message to a DTLS server configured with client port reuse and undersized input buffers; the malformed message triggers a buffer over-read during cookie validation or content parsing, resulting in a crash or controlled information leakage via crafted error responses. No named threat actors are associated with this issue.

How to fix it

Upgrade armmbed/mbedtls to commit dd79db10014d85b26d11fe57218431f2e5ede6f2 or later (2.28.1+ or 3.2.0+), and gpac to 1.0.1+dfsg1-4+deb11u3 or commit ea7395f39f601a7750d48d606e9d10ea0b7beefe. Disable MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE where feasible until patched.

How to confirm the fix worked

Verify library versions against fixed commits or package releases; confirm MBEDTLS_SSL_IN_CONTENT_LEN meets or exceeds required thresholds after update; perform DTLS handshake tests with malformed ClientHello payloads to ensure no over-read occurs.

Typical attack path

1. Identify publicly reachable DTLS endpoints using Mbed TLS with DTLS client port reuse enabled
2. Craft and transmit an invalid ClientHello packet sized to trigger over-read under the affected content length limits
3. Observe server response for crash indicators or error messages that may disclose heap memory contents

How to detect it

Review DTLS server logs and crash dumps for unexpected terminations or error responses during ClientHello processing; correlate with network captures showing anomalous DTLS handshake packets from untrusted sources.

What your security team should do

• Prioritize patching Mbed TLS and dependent packages (gpac) to the listed fixed versions within standard maintenance windows given low EPSS and absence from KEV
• Audit configurations for MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE and reduce MBEDTLS_SSL_IN_CONTENT_LEN exposure
• Monitor upstream advisories for any changes in exploit maturity