GHSA-p3r6-mx6c-33gq: Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

Published Aug 10, 2026

Updated

tlsoptdtlspeerconnectionidvalueget() in subsys/net/lib/sockets/socketstls.c, which handles getsockopt(SOLTLS, TLSDTLSPEERCIDVALUE), passed the caller-supplied optval directly to mbedtlssslgetpeercid() without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX (default 32) bytes. mbedtlssslgetpeercid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLSSSLCIDOUTLENMAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end.

In CONFIGUSERSPACE builds the getsockopt syscall verifier (zvrfyzsockgetsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (kusermodeallocfromcopy -> zthreadmalloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID.

The defect requires CONFIGMBEDTLSSSLDTLSCONNECTIONID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIGUSERSPACE. Introduced when the TLSDTLSCID option was added (v3.5.0).

The fix rejects callers whose optlen is below MBEDTLSSSLCIDOUTLENMAX with -EINVAL.

Affected Software

1 affected component

Zephyr Zephyr>=3.5.0

Event History

Aug 10, 2026

CVE Published

via OSV·10:40 PM

Data Sourced

via OSV·10:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to the kernel-heap overflow path?

The kernel-crossing path requires CONFIG_USERSPACE, CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, and a connected DTLS socket whose session has negotiated a peer Connection ID. An unprivileged user thread must be able to invoke getsockopt on that socket.

What must an attacker be able to do to trigger the issue?

They need local low-privilege access sufficient to call getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE) on an established eligible DTLS socket and supply an optlen smaller than the negotiated peer CID length. The overflow data consists of the remote peer's Connection ID.

How can I determine whether a system is affected?

Check whether the build enables CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID and, for the user-to-kernel overflow scenario, CONFIG_USERSPACE. Also identify code that calls getsockopt with TLS_DTLS_PEER_CID_VALUE using a caller buffer or optlen smaller than the peer-negotiated CID length.

GHSA-p3r6-mx6c-33gq: Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to the kernel-heap overflow path?

What must an attacker be able to do to trigger the issue?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to the kernel-heap overflow path?

What must an attacker be able to do to trigger the issue?

How can I determine whether a system is affected?