Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in Mbed TLS, a widely used cryptography library. This issue could allow for unauthorized access and manipulation of sensitive data if exploited, impacting the integrity and confidentiality of systems that utilize this library without proper configuration. The primary concern is to verify if our environment is affected by this vulnerability.
- Stack overflow in cryptography library functions.
- Affects data protection and system integrity.
- Confirm relevance and identify exposure.
Attack Path
How an attacker could exploit the issue
An attacker could reach this vulnerability by making a specially crafted request to an application that directly uses the affected Mbed TLS functions, provided that PSA cryptography is disabled. This could allow the attacker to crash the application or potentially execute their own code.
- No authentication required to reach.
- Triggered by malformed cryptographic parameters.
- Enables remote code execution.
Live Threat
Current exploitation, exposure, and threat context
A stack buffer overflow could occur in specific Mbed TLS functions when processing Elliptic Curve Digital Signature Algorithm (ECDSA) data with an unsupported bit size. This may affect applications that directly call these functions, when configured without PSA support.
- Affects cryptographic operations.
- Exposure via direct function calls.
- Could lead to denial of service.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams responsible for applications that directly call the `mbedtls_ecdsa_der_to_raw()` or `mbedtls_ecdsa_raw_to_der()` functions, particularly those with PSA disabled, must urgently assess their exposure. The first step is to identify all instances of the affected Mbed TLS version, confirm their network reachability and business criticality, and then locate the accountable application owner to plan remediation.
- Application owners should address this issue.
- Verify direct function calls and PSA configuration.
- Plan remediation based on confirmed exposure.
