CVE-2022-46393

Vulnerability

A heap-based buffer overflow and overread vulnerability exists in Mbed TLS's DTLS implementation when MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. Affected versions are Mbed TLS before 2.28.2 and 3.x before 3.3.0 [1][2].

Exploitation

An attacker with network access can send specially crafted DTLS messages containing an oversized Connection ID (CID) to trigger the heap buffer overflow or overread. No authentication is required, but the feature must be enabled with the vulnerable configuration [2].

Impact

Successful exploitation could lead to heap memory corruption (overwrite or overread), potentially allowing information disclosure or denial of service. In the worst case, code execution may be possible, though this is not confirmed [2].

Mitigation

Upgrade to Mbed TLS 2.28.2 or 3.3.0, which contain the fix for this issue [1][2]. No workaround is available if the CID feature is required; otherwise, disable it by not defining MBEDTLS_SSL_DTLS_CONNECTION_ID. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.