Cloudanix VulnDB

CVE-2022-46393

Critical · 9.8

CVSS

9.8

EPSS

1.3%

Published

Dec 15, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a widely used encryption library can let attackers crash or seize control of devices that use certain secure connection features over the network.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Potential heap-based buffer overflow and heap-based buffer over-read in DTLS connection ID processing when MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX exceeds twice MBEDTLS_SSL_CID_OUT_LEN_MAX.

Why it matters to the business

Embedded and IoT systems relying on Mbed TLS for secure DTLS communications face risk of remote crashes or code execution, which can disrupt device operations and expose sensitive data flows.

How an attack unfolds

An attacker sends crafted DTLS packets containing manipulated connection identifiers that exploit the length mismatch between input and output CID maximums, triggering memory corruption during handshake or record processing.

How to fix it

Upgrade mbed-tls/mbedtls to the fixed commit 89f040a5c938985c5f30728baed21e49d0846a53, equivalent to versions 2.28.2 or 3.3.0 and later; disable MBEDTLS_SSL_DTLS_CONNECTION_ID if the feature is unnecessary.

How to confirm the fix worked

Confirm deployed Mbed TLS version meets or exceeds 2.28.2 or 3.3.0; review build configuration to ensure vulnerable macro combinations are not active; perform DTLS connection tests under the affected CID length settings.

Typical attack path

  1. Scan for targets exposing DTLS services using Mbed TLS with connection ID support enabled
  2. Craft malicious DTLS ClientHello or record packets with oversized CID values
  3. Deliver packets to trigger heap overflow or over-read during CID handling
  4. Leverage memory corruption for denial of service or remote code execution

How to detect it

Inspect application and system logs for DTLS handshake failures or memory-related crashes involving connection identifiers; correlate with network traffic showing anomalous CID lengths in DTLS records.

What your security team should do

  • Prioritize upgrade of all Mbed TLS instances to the fixed commit within the next maintenance window
  • Audit configurations to disable DTLS connection IDs where not required
  • Incorporate version checks into dependency scanning pipelines

The record

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 mbedtls 0 2.28.2-1
Debian:13 mbedtls 0 2.28.2-1
Debian:14 mbedtls 0 2.28.2-1
SUSE:Package Hub 15 SP4 mbedtls 0 2.28.0-bp154.2.3.1
Ubuntu:16.04:LTS mbedtls 0 No fix
Ubuntu:18.04:LTS mbedtls 0 No fix
Ubuntu:20.04:LTS mbedtls 0 No fix
Ubuntu:22.04:LTS mbedtls 0 No fix
Ubuntu:24.04:LTS mbedtls 0 No fix
Ubuntu:24.10 mbedtls 0 No fix
Ubuntu:25.04 mbedtls 0 No fix
Ubuntu:Pro:16.04:LTS mbedtls 0 No fix
Ubuntu:Pro:18.04:LTS mbedtls 0 No fix
Ubuntu:Pro:20.04:LTS mbedtls 0 No fix
openSUSE:Leap 15.4 mbedtls 0 2.28.0-bp154.2.3.1
openSUSE:Tumbleweed mbedtls-2 0 2.28.2-1.1
openSUSE:Tumbleweed mbedtls-3 0 3.6.6-1.1

Related vulnerabilities