From baf449db7e31f031ed5def0fecf417122f72d3ee Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 1 May 2026 10:23:02 +0100 Subject: [PATCH 1/7] Added fix for Integer overflow using a large ECDHE Identity Signed-off-by: Ben Taylor --- library/ssl_tls12_client.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index c101ccd91e..cbdffe88ad 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2470,11 +2470,16 @@ static int ssl_write_client_key_exchange(mbedtls_ssl_context *ssl) /* uint16 to store content length */ const size_t content_len_size = 2; + const size_t ecpoint_len_size = 1; + const size_t ecpoint_max_len = + PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(handshake->xxdh_psa_type, + handshake->xxdh_psa_bits); header_len = 4; - if (header_len + content_len_size + ssl->conf->psk_identity_len - > MBEDTLS_SSL_OUT_CONTENT_LEN) { + if (ecpoint_max_len > MBEDTLS_SSL_OUT_CONTENT_LEN - ecpoint_len_size || + header_len + content_len_size + ssl->conf->psk_identity_len + > MBEDTLS_SSL_OUT_CONTENT_LEN - ecpoint_len_size - ecpoint_max_len) { MBEDTLS_SSL_DEBUG_MSG(1, ("psk identity too long or SSL buffer too short")); return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; From e71e49e634ba49b2b630f268bc8f0dd392751ec3 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 1 May 2026 10:26:49 +0100 Subject: [PATCH 2/7] Add ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/ecdh-psk-integer-overflow.txt | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 ChangeLog.d/ecdh-psk-integer-overflow.txt diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt new file mode 100644 index 0000000000..0c84914a45 --- /dev/null +++ b/ChangeLog.d/ecdh-psk-integer-overflow.txt @@ -0,0 +1,2 @@ +Bugfix + * Add fix for ecdh-psk integer overflow with large identity. From c058818451833a748da112e3b8129fd299480ceb Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 3 Jun 2026 08:26:17 +0100 Subject: [PATCH 3/7] Improve ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/ecdh-psk-integer-overflow.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt index 0c84914a45..c1b7f6affa 100644 --- a/ChangeLog.d/ecdh-psk-integer-overflow.txt +++ b/ChangeLog.d/ecdh-psk-integer-overflow.txt @@ -1,2 +1,2 @@ -Bugfix - * Add fix for ecdh-psk integer overflow with large identity. +Security + * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled. From c567299ee6bade9547a97d3ad1dcd5f3bd98ea6f Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 3 Jun 2026 09:44:12 +0100 Subject: [PATCH 4/7] Add in tests for ECDHE-PSK integer overflow Signed-off-by: Ben Taylor --- tests/ssl-opt.sh | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 4a4ee4d1ef..9ab566944d 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -8382,6 +8382,37 @@ run_test "extKeyUsage cli-auth 1.3: codeSign -> fail (hard)" \ -s "Processing of the Certificate handshake message failed" # MBEDTLS_X509_BADCERT_EXT_KEY_USAGE -> MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT +# Miscellaneous PSK-related tests + +psk_identity_max_minus_10=a$(printf "%$((MAX_OUT_LEN - 11))s" z | tr ' ' .) + +run_test "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 7)" \ + "$P_SRV debug_level=3 \ + psk_identity=${psk_identity_max_minus_10}987 psk=73776f726466697368" \ + "$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \ + psk_identity=${psk_identity_max_minus_10}987 psk=73776f726466697368" \ + 1 \ + -s "! mbedtls_ssl_handshake returned" \ + -c "! mbedtls_ssl_handshake returned" + +run_test "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 6)" \ + "$P_SRV debug_level=3 \ + psk_identity=${psk_identity_max_minus_10}9876 psk=73776f726466697368" \ + "$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \ + psk_identity=${psk_identity_max_minus_10}9876 psk=73776f726466697368" \ + 1 \ + -s "! mbedtls_ssl_handshake returned" \ + -c "! mbedtls_ssl_handshake returned" + +run_test "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 5)" \ + "$P_SRV debug_level=3 \ + psk_identity=${psk_identity_max_minus_10}98765 psk=73776f726466697368" \ + "$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \ + psk_identity=${psk_identity_max_minus_10}98765 psk=73776f726466697368" \ + 1 \ + -s "! mbedtls_ssl_handshake returned" \ + -c "! mbedtls_ssl_handshake returned" + # Tests for PSK callback run_test "PSK callback: psk, no callback" \ From 0501e447cc19ed06b69daea5e17585e1294030cd Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 3 Jun 2026 10:38:21 +0100 Subject: [PATCH 5/7] Correct style of ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/ecdh-psk-integer-overflow.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt index c1b7f6affa..7d4b452275 100644 --- a/ChangeLog.d/ecdh-psk-integer-overflow.txt +++ b/ChangeLog.d/ecdh-psk-integer-overflow.txt @@ -1,2 +1,3 @@ Security - * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled. + * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when + CBC is disabled. From ab2a7d5a3472f39190344f754e6cee5039fcba50 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 4 Jun 2026 14:20:18 +0100 Subject: [PATCH 6/7] Add reported by and CVE placeholder Signed-off-by: Ben Taylor --- ChangeLog.d/ecdh-psk-integer-overflow.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt index 7d4b452275..8693dde60e 100644 --- a/ChangeLog.d/ecdh-psk-integer-overflow.txt +++ b/ChangeLog.d/ecdh-psk-integer-overflow.txt @@ -1,3 +1,3 @@ Security * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when - CBC is disabled. + CBC is disabled. Reported by Karnakar Reddy. CVE-ID-TODO From 911b9b67dbf335f79253c2b66acc9767e34b3105 Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 15:48:14 +0100 Subject: [PATCH 7/7] Add CVE ID to ChangeLog Co-authored-by: Gilles Peskine Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/ecdh-psk-integer-overflow.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt index 8693dde60e..47dfd428de 100644 --- a/ChangeLog.d/ecdh-psk-integer-overflow.txt +++ b/ChangeLog.d/ecdh-psk-integer-overflow.txt @@ -1,3 +1,3 @@ Security * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when - CBC is disabled. Reported by Karnakar Reddy. CVE-ID-TODO + CBC is disabled. Reported by Karnakar Reddy. CVE-2026-50580