Remote code execution in mbed TLS - CVE-2018-0488

Vulnerability identifier: #VU10943

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0488

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.

The weakness exists due to improper processing of crafted packets when using the truncated HMAC extension and CBC. A remote attacker can send a specially crafted input and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

mbed TLS
Debian Linux
Gentoo Linux
Fedora
mbedtls (Ubuntu package)
mbedtls (Alpine package)
mbedtls

Update to versions 1.3.22, 2.1.10 or 2.7.0.

mbedtls (Ubuntu package) - update to 2.2.1-2ubuntu0.3
mbedtls (Alpine package) - update to 2.7.0-r0
mbedtls - addressed in versions 2.7.0-1.el6, 2.7.0-1.el7, 2.7.0-1.fc26, 2.7.0-1.fc27

• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01

• Remote code execution in ARM mbed TLS
• Debian update for mbedtls
• Debian update for polarssl
• Gentoo update for mbed TLS
• Ubuntu update for ARM mbed TLS
• Remote code execution in mbedtls (Alpine package)
• Fedora EPEL 6 update for mbedtls
• Fedora EPEL 7 update for mbedtls
• Fedora 26 update for mbedtls
• Fedora 27 update for mbedtls