CVE-2024-23775

What it actually does

Integer overflow in mbedtls_x509_set_extension() allows crafted X.509 extension data to trigger memory corruption and denial of service.

Why it matters to the business

Systems relying on Mbed TLS for certificate validation can be crashed remotely, causing service outages and operational disruption until patched.

How an attack unfolds

An attacker crafts a malicious X.509 certificate containing an extension that triggers the integer overflow when parsed by mbedtls_x509_set_extension, resulting in a crash or DoS condition without authentication.

How to fix it

Upgrade armmbed/mbedtls to version 2.28.7 or later for the 2.x branch and 3.5.2 or later for the 3.x branch; apply commit 555f84735aecdbd76a566cf087ec8425dfb0c8ab.

How to confirm the fix worked

Confirm deployed version is at or above the fixed releases, recompile and test certificate parsing with boundary-value extension lengths, and monitor for crashes in mbedtls_x509 functions.

Typical attack path

1. Locate services or devices using vulnerable Mbed TLS versions for X.509 processing
2. Generate a certificate with a specially crafted extension field
3. Deliver the certificate over a network protocol that triggers parsing
4. Invoke mbedtls_x509_set_extension during validation
5. Trigger the overflow leading to process termination or DoS

How to detect it

Review application and system logs for segmentation faults or crashes during certificate parsing, correlate with inbound X.509 data containing large or malformed extensions, and inspect process dumps for mbedtls_x509_set_extension activity.

What your security team should do

• Immediately upgrade all instances of Mbed TLS to the fixed versions
• Scan codebases and dependencies for use of mbedtls_x509_set_extension
• Implement network-level rate limiting on certificate-heavy endpoints
• Add monitoring for abnormal termination of processes using Mbed TLS