CVE-2021-44732
CRITICALMbed TLS < 3.0.1 - Double Free in Out-of-Memory Conditions
Title source: llmDescription
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
References (8)
Core 8
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
Issue Tracking, Mailing List, Third Party Advisory
https://bugs.gentoo.org/829660
Release Notes
https://github.com/ARMmbed/mbedtls/releases
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0
Exploit, Mitigation, Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12
Scores
CVSS v3
9.8
EPSS
0.0090
EPSS Percentile
75.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-415
Status
published
Products (3)
arm/mbed_tls
3.0.0 (2 CPE variants)
arm/mbed_tls
< 2.16.12
debian/debian_linux
10.0
Published
Dec 20, 2021
Tracked Since
Feb 18, 2026