mbedtls/buf-overread-use-psa-static-ecdh.txt at a4a4aab54294e47f10f2e742c3eb13851473e7ea - mbedtls - CoffeeCat

coffee/mbedtls

mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-12 09:24:15 +08:00

Manuel Pégourié-Gonnard 37e5999ac3 Fix potential buffer overread with USE_PSA

Using opaque keys for static ECDH is not supported in this branch (will
be introduced in 3.2). In case we reach that point, error out cleanly
instead of miscasting a pointer. Since opaque keys were introduced,
mbedtls_pk_can_do() was no longer a precise enough check.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

2022-06-20 21:04:31 +02:00

7 lines

338 B

Plaintext

Raw Blame History

 Security
    * Fix a potential heap buffer overread in TLS 1.2 server-side when
      MBEDTLS_USE_PSA_CRYPTO is enabled, an opaque key (created with
      mbedtls_pk_setup_opaque()) is provisioned, and a static ECDH ciphersuite
      is selected. This may result in an application crash. No path to
      information leak has been identified.