CVE-2024-23775: 
Mbed TLS vulnerability analysis and mitigation

The CVE-2024-23775 is an Integer Overflow vulnerability discovered in Mbed TLS, affecting versions 2.x before 2.28.7 and 3.x before 3.5.2. The vulnerability was disclosed on January 9, 2024, and impacts the mbedtls_x509_set_extension() function. This security flaw affects all versions of Mbed TLS up to and including 2.28.6 and 3.5.1 (Mbed Advisory).

The vulnerability occurs due to a failure to validate inputs passed to the mbedtls_x509_set_extension() function. This oversight can lead to an integer overflow condition, resulting in the allocation of a zero-length buffer intended to hold the extension. When the extension is subsequently copied into this buffer, it causes a heap buffer overflow (Mbed Advisory).

The vulnerability has been assessed as having a Low severity rating. If exploited, it can potentially cause a denial of service (DoS) condition through segmentation faults resulting from the buffer overflow (Mbed Advisory).

Users are advised to upgrade to Mbed TLS version 3.5.2 or 2.28.7, depending on their current branch. As a workaround, users should ensure that a length of SIZE_MAX cannot be passed into the mbedtls_x509_set_extension() function (Mbed Advisory).