Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

mbedTLS: Buffer overflow security issue, requires upgrade to 2.7.0 #6025

Closed
pfalcon opened this issue Feb 7, 2018 · 1 comment
Closed

mbedTLS: Buffer overflow security issue, requires upgrade to 2.7.0 #6025

pfalcon opened this issue Feb 7, 2018 · 1 comment
Assignees
@lpereira
Labels
area: Networking area: Security Security bug The issue is a bug, or the PR is fixing a bug priority: high High impact/importance bug
Milestone
v1.11.0

Comments

@pfalcon
Copy link
Contributor

pfalcon commented Feb 7, 2018 •
edited
Loading

There is a pretty obvious, blatant buffer overflow possibility in the mbedTLS codebase (2.6.0) used by Zephyr as of now. It was fixed in 2.7.0 by this commit: Mbed-TLS/mbedtls@0b7b83fd9 .

In the interest of establishing Zephyr as the secure codebase, we should upgrade included mbedTLS for the 1.11 release.
@pfalcon pfalcon added priority: high High impact/importance bug area: Networking area: Security Security labels Feb 7, 2018
@pfalcon
Copy link
Contributor Author

pfalcon commented Feb 7, 2018

@lpereira : FYI as the author of b9bc24c
@jukkar : FYI

@pfalcon pfalcon added this to the v1.11.0 milestone Feb 7, 2018
@nashif nashif assigned lpereira and unassigned d3zd3z, nashif, carlescufi and agross-oss Feb 7, 2018
@nashif nashif added the bug The issue is a bug, or the PR is fixing a bug label Feb 7, 2018
@galak galak mentioned this issue Feb 7, 2018
Merged
galak added a commit to galak/zephyr that referenced this issue Feb 7, 2018
@galak
crypto: mbedtls: Update mbedTLS to 2.7.0
7888ad5 
Due to a security advisory released on February 1st 2018[1], it's
advisable to update mbedTLS to 2.7.0.

The vulnerability, identified as CVE-2018-0488 and CVE-2018-0487, risk
remote code execution when truncated HMAC is enabled or when verifying
RSASSA-PSS signatures.

[1] https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01

Fixes: zephyrproject-rtos#6025

Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
@pfalcon pfalcon mentioned this issue Feb 7, 2018
Closed
8 tasks
nashif pushed a commit that referenced this issue Feb 7, 2018
@galak
crypto: mbedtls: Update mbedTLS to 2.7.0
bb72c3d 
Due to a security advisory released on February 1st 2018[1], it's
advisable to update mbedTLS to 2.7.0.

The vulnerability, identified as CVE-2018-0488 and CVE-2018-0487, risk
remote code execution when truncated HMAC is enabled or when verifying
RSASSA-PSS signatures.

[1] https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01

Fixes: #6025

Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lpereira lpereira

Labels
area: Networking area: Security Security bug The issue is a bug, or the PR is fixing a bug priority: high High impact/importance bug
Projects
None yet
Milestone
v1.11.0
Development

No branches or pull requests
6 participants
@lpereira @d3zd3z @nashif @pfalcon @carlescufi @agross-oss