CVE-2024-45158

What it actually does

A stack buffer overflow occurs in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() when the bits parameter exceeds the largest supported curve size, leading to memory corruption in configurations with PSA disabled where applications invoke these functions directly.

Why it matters to the business

Successful exploitation can result in remote code execution or denial of service, enabling attackers to compromise systems, exfiltrate data, or disrupt operations in environments relying on the vulnerable cryptography library.

How an attack unfolds

An attacker identifies an application that directly calls the affected functions, supplies crafted ECDSA data with an oversized bits parameter to trigger the overflow, and leverages the corruption to execute arbitrary code or crash the process.

How to fix it

Upgrade Mbed TLS to 3.6.1 or later. For mysql-client (Bitnami) update to version 10.4.25.

How to confirm the fix worked

Confirm the installed Mbed TLS version is at least 3.6.1, review application code for direct calls to the functions, and test with oversized bits parameters to ensure no overflow occurs.

Typical attack path

1. Scan for applications exposing or using direct calls to mbedtls_ecdsa_der_to_raw or mbedtls_ecdsa_raw_to_der
2. Craft malicious input containing an ECDSA structure with bits larger than supported curves
3. Deliver the input to the target application to trigger the stack overflow
4. Exploit memory corruption for code execution or service disruption

How to detect it

Monitor application logs and crash reports for errors related to ECDSA conversion functions or unexpected terminations when processing certificate or signature data; review process dumps for signs of stack corruption.

What your security team should do

• Immediately update all affected packages to the fixed versions listed
• Audit source code for any direct invocations of the vulnerable functions
• Implement input validation around ECDSA parameter handling in custom applications