CVE-2018-9988

Vulnerability

ARM mbed TLS versions before 2.1.11, before 2.7.2, and before 2.8.0 contain a buffer over-read vulnerability in the ssl_parse_server_key_exchange() function. The issue arises from an incorrect bounds check: the code checks end != p + sig_len instead of p != end - sig_len, which can cause an arithmetic overflow and allow reading beyond the input buffer [1]. Additionally, a missing bounds check before reading the signature length (sig_len) can lead to a similar out-of-bounds read [2].

Exploitation

An unauthenticated attacker with network access can send a crafted TLS ServerKeyExchange message to trigger the over-read. No special privileges or user interaction are required. The attacker only needs to establish a TLS connection and send a malicious handshake message.

Impact

Successful exploitation results in a denial of service (crash) due to reading invalid memory. There is no evidence of code execution or information disclosure beyond potential memory corruption.

Mitigation

The vulnerability is fixed in mbed TLS versions 2.1.11, 2.7.2, and 2.8.0 [1][2]. Users should upgrade to these or later versions. No known workarounds exist for unpatched installations.