Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mbed_tls | Arm | * | 2.16.12 (excluding) |
| Mbed_tls | Arm | 2.17.0 (including) | 2.28.0 (excluding) |
| Mbed_tls | Arm | 3.0.0 (including) | 3.0.0 (including) |
| Mbed_tls | Arm | 3.0.0-preview1 (including) | 3.0.0-preview1 (including) |
| Mbedtls | Ubuntu | bionic | * |
| Mbedtls | Ubuntu | hirsute | * |
| Mbedtls | Ubuntu | impish | * |
| Mbedtls | Ubuntu | kinetic | * |
| Mbedtls | Ubuntu | lunar | * |
| Mbedtls | Ubuntu | mantic | * |
| Mbedtls | Ubuntu | trusty | * |
| Mbedtls | Ubuntu | xenial | * |