CVE-2024-45158 Memory corruption in n/a
A stack buffer overflow in Mbed TLS allows attackers to cause denial of service or execute arbitrary code when specific API functions are called with large bit parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45158?
CVE-2024-45158 is a critical memory corruption vulnerability in n/a, published on 5 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.)
Weakness: CWE-121
Which versions are affected by CVE-2024-45158?
It affects 1 product.
Products include Trustedfirmware Mbed Tls.
How do I fix CVE-2024-45158?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-45158 being exploited?
There is no known exploitation of CVE-2024-45158 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-34875 Memory corruption in n/a
- CVE-2024-49195 Memory corruption in n/a
- CVE-2024-45159 Auth bypass in n/a
- CVE-2023-45199 Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.
- CVE-2026-34873 An issue was discovered in Mbed TLS 3.5.0 through 4.0.0.
Sources
Also known as ALPINE-CVE-2024-45158, GHSA-hw5v-7r63-g2h6.