Critical severity · published Sep 5, 2024
CVE-2024-45158
An issue was discovered in Mbed TLS 3.6 before 3.6.1
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
Mbed Tls · Trustedfirmware
3.6.0 · source: NVD
MB
Mbedtls · Mbed
3.6 before 3.6.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45158
Release Notes
https://github.com/Mbed-TLS/mbedtls/releases/
Vendor Advisory
https://mbed-tls.readthedocs.io/en/latest/security-advisories/
Vendor Advisory
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-2/
More from Mbed Tls
9.8
CVE-2026-34877
An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0
9.8
CVE-2026-34875
An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0
9.8
CVE-2024-49195
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
9.8
CVE-2024-45159
An issue was discovered in Mbed TLS 3.x before 3.6.1
9.8
CVE-2023-45199
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution