Description

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end. In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID. The defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0). The fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-10T23:16:51.587Z",
  "pubdate": "2026-08-10T23:16:51.587Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the getsockopt implementation of the networking subsystem, specifically within the TLS socket handling logic. The flaw allows an unprivileged user thread in CONFIG_USERSPACE builds to cause a kernel-heap buffer overflow by providing an insufficiently sized optval buffer when querying the TLS_DTLS_PEER_CID_VALUE option. Successful exploitation results in memory corruption within the kernel heap with attacker-controlled or peer-controlled data, potentially leading to system instability or arbitrary kernel memory manipulation. The vulnerability impacts systems running affected versions of the Zephyr RTOS with specific networking and cryptographic configurations enabled. Exploitation requires the attacker to have execution capabilities within the user space, the CONFIG_USERSPACE and CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID features to be enabled, an established DTLS session with a negotiated peer Connection ID, and the ability to issue getsockopt system calls with manipulated parameters.",
  "technicalDetails": "The vulnerability resides in the function tls_opt_dtls_peer_connection_id_value_get() located in subsys/net/lib/sockets/sockets_tls.c. This function handles getsockopt requests utilizing the SOL_TLS level and the TLS_DTLS_PEER_CID_VALUE option. The root cause of the vulnerability is the lack of proper bounds checking on the caller-supplied optval buffer before passing it to the underlying mbedtls_ssl_get_peer_cid() function. Specifically, the code fails to verify that the provided buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX, which defaults to 32 bytes.\nThe mbedtls_ssl_get_peer_cid() function copies the peer-negotiated DTLS Connection ID, which has a length ranging from 1 to MBEDTLS_SSL_CID_OUT_LEN_MAX bytes, directly into the provided destination buffer without accepting a destination size parameter. When an unprivileged user thread executes this code path on systems compiled with CONFIG_USERSPACE, the getsockopt syscall verifier function z_vrfy_zsock_getsockopt utilizes bounce-buffering. It allocates a kernel memory region of exactly optlen bytes via k_usermode_alloc_from_copy and z_thread_malloc. If an attacker supplies an optlen smaller than the actual size of the CID, mbedtls_ssl_get_peer_cid() writes past the boundary of the allocated kernel heap buffer by up to 31 bytes.\nThe attack flow proceeds as follows: First, an attacker establishes a DTLS session on a socket where the DTLS Connection ID feature is enabled and successfully negotiated. Second, the attacker invokes the getsockopt system call specifying SOL_TLS, TLS_DTLS_PEER_CID_VALUE, and a deliberately reduced optlen value paired with an undersized optval buffer. Third, the system verifier allocates a kernel heap buffer matching the small optlen size. Fourth, the vulnerable tls_opt_dtls_peer_connection_id_value_get() function passes this undersized buffer directly to mbedtls_ssl_get_peer_cid() without validation. Fifth, mbedtls_ssl_get_peer_cid() writes the remote peer CID into the buffer, overflowing the kernel heap allocation with up to 31 bytes of out-of-bounds data.\nThe vulnerable component is the getsockopt handler for TLS sockets in the Zephyr networking subsystem. The affected software versions start from v3.5.0, which is when the TLS_DTLS_CID option was initially introduced. Prerequisites for triggering the flaw include CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, CONFIG_USERSPACE, an active DTLS session with a peer CID, and local unprivileged execution access to issue system calls."
}