|Title||Double Free in
|Date||14th of December, 2021|
|Affects||All versions of Mbed TLS|
|Impact||An attacker could create memory / heap corruption.|
mbedtls_ssl_get_session() were to fail with
MBEDTLS_ERR_SSL_ALLOC_FAILED (in an out of memory condition), then calling
mbedtls_ssl_free() in the usual manner would cause an internal session buffer to be freed twice, due to two structures both having valid pointers to it after a call to
An attacker could potentially trigger the out of memory condition, and therefore use this bug to create memory corruption, which could then be further exploited or targetted.
Affected users will want to upgrade to Mbed TLS 3.1.0, 2.28.0 or 2.16.12 depending on the branch they're currently using.
Either do not call
mbedtls_ssl_session_free() (which will unfortunately cause a memory leak) or set the
ticket to NULL manually, in the case where either