CVE-2026-8718: Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS
tlsoptdtlspeerconnectionidvalueget() in subsys/net/lib/sockets/socketstls.c, which handles getsockopt(SOLTLS, TLSDTLSPEERCIDVALUE), passed the caller-supplied optval directly to mbedtlssslgetpeercid() without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX (default 32) bytes. mbedtlssslgetpeercid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLSSSLCIDOUTLENMAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end.
In CONFIGUSERSPACE builds the getsockopt syscall verifier (zvrfyzsockgetsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (kusermodeallocfromcopy -> zthreadmalloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID.
The defect requires CONFIGMBEDTLSSSLDTLSCONNECTIONID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIGUSERSPACE. Introduced when the TLSDTLSCID option was added (v3.5.0).
The fix rejects callers whose optlen is below MBEDTLSSSLCIDOUTLENMAX with -EINVAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zephyr net sockets/TLS / getsockopt(TLS_DTLS_PEER_CID_VALUE) + mbedtls_ssl_get_peer_cid() caller validationto a version that resolves this vulnerability.Fixed in v3.5.0 - Configuration
Disable CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID to avoid the DTLS peer Connection ID getsockopt path (TLS_DTLS_PEER_CID_VALUE) being reachable when an established DTLS session with a negotiated peer CID exists.
Zephyr net sockets/TLS CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID = disabled (not enabled) - Configuration
If applicable, disable CONFIG_USERSPACE builds to avoid the kernel-crossing bounce-buffer path (k_usermode_alloc_from_copy -> z_thread_malloc) that can induce a kernel-heap buffer overflow for getsockopt on DTLS sockets with Connection ID enabled.
Zephyr CONFIG_USERSPACE builds (userspace syscall verifier z_vrfy_zsock_getsockopt) CONFIG_USERSPACE = disabled (not enabled)