CVE-2024-45158: Buffer Overflow
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtlsecdsadertoraw() and mbedtlsecdsarawtoder() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45158?
CVE-2024-45158 has a high severity due to its potential for causing stack buffer overflows.
How do I fix CVE-2024-45158?
To fix CVE-2024-45158, update Mbed TLS to version 3.6.1 or later.
What versions of Mbed TLS are affected by CVE-2024-45158?
Mbed TLS versions prior to 3.6.1 are affected by CVE-2024-45158.
What is the impact of CVE-2024-45158?
CVE-2024-45158 can lead to buffer overflows, potentially allowing remote code execution or data corruption.
Is PSA support relevant for CVE-2024-45158?
Yes, in some configurations with PSA disabled, all values of bits are affected by CVE-2024-45158.