CVE-2017-2784: High severity Arm mbed TLS vulnerability
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2784?
CVE-2017-2784 is considered high severity due to the potential for an attacker to execute arbitrary code through specially crafted x509 certificates.
How do I fix CVE-2017-2784?
To mitigate CVE-2017-2784, upgrade to mbed TLS version 1.3.19 or later, 2.1.7 or later, or 2.4.2 or later.
What types of software are affected by CVE-2017-2784?
CVE-2017-2784 affects multiple versions of the ARM mbed TLS library, specifically versions prior to 1.3.19, all 2.0.x, up to 2.1.6, and up to 2.4.1.
What is the exploit method for CVE-2017-2784?
CVE-2017-2784 can be exploited by providing a specially crafted x509 certificate that can trigger a free of a stack pointer.
Are there any public exploits available for CVE-2017-2784?
As of now, there are no known public exploits specifically associated with CVE-2017-2784.