CVE-2022-42905

Deeper analysis

CVE-2022-42905 affects wolfSSL versions prior to 5.5.2 when the WOLFSSL_CALLBACKS compile-time flag is enabled. This debugging-only option activates callback functions that, under TLS 1.3, permit a heap buffer over-read of five bytes due to insufficient bounds checking on incoming handshake data.

A remote attacker can exploit the flaw without authentication by sending a crafted TLS 1.3 ClientHello or other handshake messages, either directly as a malicious client or via a man-in-the-middle position on the network. Successful exploitation discloses up to five bytes of adjacent heap memory, which may contain sensitive information such as session keys or application data, while also risking a crash that produces a denial-of-service condition.

The wolfSSL project addressed the issue in the v5.5.2-stable release by correcting the buffer handling logic inside the callback paths. Public advisories and the accompanying GitHub release notes recommend disabling WOLFSSL_CALLBACKS in all production builds, as the feature is explicitly intended only for debugging and is not required for normal operation. The associated EPSS score has remained low throughout its history and shows no material post-disclosure increase that would indicate emerging exploitation interest.