CVE-2022-47630

An attacker can craft a malicious X.509 certificate that exploits insufficient validation within the `get_ext()` function. This occurs because the function does not check the return values of underlying `mbedtls_*()` functions and incorrectly uses the end of an extension as the end pointer, while the certificate parser uses the end of the TBSCertificate. Furthermore, the parser fails to verify that the extension's content length matches the extension's declared length or that the extension block extends to the end of the TBSCertificate. This can lead to dangerous read side effects or disclosure of sensitive microarchitectural information [ref_id=1].

The vulnerability resides in the `drivers/auth/mbedtls/mbedtls_x509_parser.c` file. The `get_ext()` function is implicated due to its failure to validate the return values of `mbedtls_*()` functions and its incorrect handling of extension boundaries. The `cert_parse()` function also contributes by not adequately checking extension content lengths and their alignment within the TBSCertificate [ref_id=1].

The patches introduce several checks to properly validate X.509 extensions. Specifically, they ensure that junk data after extensions is forbidden, that at least one extension must be present, and that extensions are validated more rigorously. The patch `abb8f936fd0ad085` directly addresses the out-of-bounds read in `auth_nvctr()` by improving validation logic. These changes prevent the parser from misinterpreting malformed extension data, thereby closing the vulnerability [ref_id=1].