Buffer underrun in pkwrite when writing an opaque key pair

Title	Buffer underrun in pkwrite when writing an opaque key pair
CVE	CVE-2024-49195
Date	15 October 2024
Affects	Mbed TLS 3.5.0 to 3.6.1 included
Severity	HIGH

Vulnerability

The functions mbedtls_pk_write_key_der() and mbedtls_pk_write_key_pem() can cause a buffer underrun when the output buffer is too small in some cases. In all problematic cases:

• The compile-time option MBEDTLS_USE_PSA_CRYPTO is enabled.

• The PK context contains an opaque key (MBEDTLS_PK_OPAQUE, typically set up with mbedtls_pk_setup_opaque()).

The following cases are problematic:

• Writing an elliptic curve key pair with mbedtls_pk_write_key_der(), when the compile-time option MBEDTLS_ECP_C is enabled, with an output buffer that is smaller than the representation of the public key as an uncompressed point.

• Writing an RSA key pair with mbedtls_pk_write_key_der(), with an output buffer that is smaller than the actual output.

• Writing an RSA key pair with mbedtls_pk_write_key_pem(), if MBEDTLS_MPI_MAX_SIZE <= 420.

Each of these cases trigger a code path where the output is first written safely into an intermediate buffer. The output is then copied to the destination buffer supplied by the application code, without checking that the buffer is large enough.

Impact

The consequence of the vulnerability is a buffer underrun of up to the size of the key representation. Depending on the location of the application buffer, this can result in stack or heap corruption.

Affected versions

The vulnerability is present in Mbed TLS 3.5.x, Mbed TLS 3.6.0 and Mbed TLS 3.6.1. Earlier versions had a different implementation of the problematic cases and are not affected.

Resolution

Affected users should upgrade to Mbed TLS 3.6.2.

Work-around

Calling mbedtls_pk_write_key_der() with a buffer that is large enough for the content is always safe. Furthermore, PSA_EXPORT_KEY_PAIR_MAX_SIZE is always a safe buffer size. There are no unsafe calls to mbedtls_pk_write_key_der() within Mbed TLS itself, except when calling mbedtls_pk_write_key_pem() in the configurations described below.

mbedtls_pk_write_key_pem() is safe when MBEDTLS_MPI_MAX_SIZE >= 421 or when MBEDTLS_USE_PSA_CRYPTO is disabled.

These functions are only vulnerable when called on PK contexts of type MBEDTLS_PK_OPAQUE. Copying the key with mbedtls_pk_copy_from_psa and calling mbedtls_pk_write_key_xxx() on the resulting non-opaque key is safe.