CVE-2020-36476
📋 TL;DR
This vulnerability in Mbed TLS allows sensitive application data to remain in memory after SSL/TLS sessions, potentially exposing it to attackers who can read process memory. It affects all systems using vulnerable versions of Mbed TLS for SSL/TLS operations. The issue specifically occurs in the mbedtls_ssl_read function where plaintext buffers aren't properly cleared.
💻 Affected Systems
- Mbed TLS
- Applications using Mbed TLS library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with memory access could extract sensitive application data (passwords, session tokens, financial information) from running processes, leading to data breaches and credential theft.
Likely Case
Information disclosure where attackers with existing access to system memory could extract residual application data from SSL/TLS sessions.
If Mitigated
Minimal impact if proper memory isolation and access controls prevent unauthorized memory access.
🎯 Exploit Status
Exploitation requires ability to read process memory, typically through another vulnerability or privileged access. No public exploits have been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.24.0, 2.16.8 LTS, or 2.7.17 LTS
Vendor Advisory: https://github.com/ARMmbed/mbedtls/releases
Restart Required: Yes
Instructions:
1. Identify Mbed TLS version in use. 2. Update to patched version: 2.24.0, 2.16.8 LTS, or 2.7.17 LTS. 3. Recompile applications using Mbed TLS. 4. Restart affected services.
🔧 Temporary Workarounds
Memory Protection Controls
allImplement strict memory access controls and process isolation to prevent unauthorized memory reading
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized memory access
- Isolate affected systems and limit exposure to untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Mbed TLS version: ldd /path/to/application | grep mbedtls, then check version in library or application outputCheck Version:
strings /usr/lib/libmbedtls.so | grep '^Version' or check application's version outputVerify Fix Applied:
Verify Mbed TLS version is 2.24.0+, 2.16.8 LTS+, or 2.7.17 LTS+📡 Detection & Monitoring
Log Indicators:
- Memory access violations
- Unexpected process memory reads
Network Indicators:
- Unusual outbound data transfers from affected systems
SIEM Query:
Process:MemoryAccess AND TargetProcess:(contains 'mbedtls' OR contains affected_application)🔗 References
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17
- https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0
- https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17
- https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
