CVE-2022-46393: 
Mbed TLS vulnerability analysis and mitigation

A critical vulnerability (CVE-2022-46393) was discovered in Mbed TLS versions before 2.28.2 and 3.x before 3.3.0. The vulnerability involves potential heap-based buffer overflow and heap-based buffer over-read conditions in DTLS when specific configuration parameters are enabled (NVD, CVE).

The vulnerability occurs in DTLS when MBEDTLSSSLDTLSCONNECTIONID is enabled and MBEDTLSSSLCIDINLENMAX is greater than 2 * MBEDTLSSSLCIDOUTLENMAX. The issue has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow an attacker to cause both heap-based buffer overflow and heap-based buffer over-read conditions, potentially leading to remote code execution, information disclosure, or system crashes (NVD).

Users should upgrade to Mbed TLS version 2.28.2 or 3.3.0 or later to address this vulnerability. The fixes have been implemented in these versions and are available through the official releases (Mbed Release, Mbed Release).

The vulnerability has been acknowledged and addressed by various Linux distributions, including Fedora, which has released security updates to patch the vulnerability in their packages (Fedora Update, Fedora Update).