CVE-2026-8718

{
  "id": "CVE-2026-8718",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-10T23:16:51.587",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end.\n\nIn CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID.\n\nThe defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0).\n\nThe fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL."
    },
    {
      "lang": "es",
      "value": "tls_opt_dtls_peer_connection_id_value_get() en subsys/net/lib/sockets/sockets_tls.c, que maneja getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), pasó el optval proporcionado por el llamador directamente a mbedtls_ssl_get_peer_cid() sin verificar que el búfer tuviera al menos MBEDTLS_SSL_CID_OUT_LEN_MAX (por defecto 32) bytes. mbedtls_ssl_get_peer_cid() copia el ID de conexión DTLS negociado por el par (longitud 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) en ese búfer sin un parámetro de tamaño de destino, por lo que un optlen proporcionado por el llamador menor que el CID causa una escritura de hasta 31 bytes más allá del final del búfer.\n\nEn compilaciones CONFIG_USERSPACE, el verificador de llamadas al sistema getsockopt (z_vrfy_zsock_getsockopt) almacena en búfer de rebote el optval del usuario en una asignación del kernel de exactamente optlen bytes (k_usermode_alloc_from_copy   -mayor que   z_thread_malloc), por lo que un hilo de usuario sin privilegios que pasa un optlen pequeño en un socket DTLS conectado con el ID de conexión habilitado induce un desbordamiento de búfer del heap del kernel, siendo el contenido desbordado el CID del par remoto.\n\nEl defecto requiere CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, una sesión DTLS establecida con un CID de par negociado, y (para el caso de cruce de kernel) CONFIG_USERSPACE. Introducido cuando se añadió la opción TLS_DTLS_CID (v3.5.0).\n\nLa solución rechaza a los llamadores cuyo optlen es inferior a MBEDTLS_SSL_CID_OUT_LEN_MAX con -EINVAL."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/net/lib/sockets/sockets_tls.c"
          ],
          "versions": [
            {
              "version": "3.5.0",
              "lessThan": "4.4.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T18:49:17.354008Z",
          "id": "CVE-2026-8718",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/aa317825a55a401315e8e17f620c70c02e8f176d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p3r6-mx6c-33gq",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p3r6-mx6c-33gq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}