CVE-2021-44732: Arm Mbed TLS Use-After-Free Vulnerability

CVE-2021-44732 Overview

CVE-2021-44732 is a double free vulnerability in Arm Mbed TLS versions before 3.0.1. The flaw occurs under specific out-of-memory conditions and can be triggered by an mbedtls_ssl_set_session() failure. Mbed TLS is a widely deployed cryptographic library used in embedded systems, IoT devices, and network appliances. The defect is classified as [CWE-415] Double Free and affects the integrity, confidentiality, and availability of systems that link against the library. Debian Linux 10 (Buster) is among the downstream distributions that received fixes through Long Term Support backports.

Critical Impact
A network-reachable attacker can trigger memory corruption in TLS sessions by exhausting memory, potentially leading to remote code execution against services using Mbed TLS.

Affected Products

Arm Mbed TLS versions prior to 3.0.1
Arm Mbed TLS 3.0.0 (including preview1)
Debian Linux 10 (Buster)

Discovery Timeline

2021-12-20 - CVE-2021-44732 published to NVD
2022-12 - Debian LTS security update released for Debian 10
2025-06 - Additional Debian LTS advisory issued
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-44732

Vulnerability Analysis

The vulnerability resides in the session handling code path of Mbed TLS. When mbedtls_ssl_set_session() is invoked and an internal memory allocation fails, the cleanup logic releases the same heap object twice. The double free corrupts the allocator's metadata, which can lead to crashes, denial of service, or controlled heap manipulation depending on the allocator implementation.

Mbed TLS is deeply embedded in firmware, VPN clients, MQTT brokers, and TLS-enabled microservices. The vulnerability is reachable through standard TLS session reuse operations, which makes the attack surface broad. Memory exhaustion can be induced by an attacker who initiates many concurrent or large TLS sessions against the target service.

Root Cause

The root cause is improper error handling in the out-of-memory failure path of session management. After the first deallocation, the pointer is not cleared, and a subsequent cleanup routine frees the same allocation. This violates safe memory management invariants and falls under [CWE-415].

Attack Vector

The attack vector is the network. An attacker who can reach a TLS endpoint built on Mbed TLS can attempt to exhaust allocator memory while triggering session-set operations. No authentication or user interaction is required. The exploitability of the double free for code execution depends on the allocator and target platform, but the condition reliably produces denial of service.

No verified public exploit code is available. Refer to the Mbed TLS Security Advisory 2021-12 for the upstream technical description.

Detection Methods for CVE-2021-44732

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libmbedtls, libmbedcrypto, or libmbedx509.
Allocator diagnostic messages indicating double free or heap corruption in TLS-enabled services.
Repeated TLS handshake failures accompanied by abnormal memory growth on the target host.

Detection Strategies

Inventory all binaries linking against Mbed TLS and compare versions against the fixed releases 2.16.12, 2.28.0, and 3.1.0.
Enable allocator hardening such as MALLOC_CHECK_ or AddressSanitizer in test environments to surface double free conditions during fuzzing.
Monitor service logs for repeated mbedtls_ssl_set_session errors correlated with memory pressure events.

Monitoring Recommendations

Track process restart counts and core dump generation for TLS-facing services using EDR or host telemetry.
Alert on sustained high memory utilization on hosts running embedded TLS workloads, since attackers must induce out-of-memory conditions.
Forward host crash telemetry into a centralized analytics platform for correlation across the fleet.

How to Mitigate CVE-2021-44732

Immediate Actions Required

Upgrade Mbed TLS to version 3.0.1 or later. For the long-term support branches, upgrade to 2.16.12 or 2.28.0.
Apply the Debian LTS package updates referenced in the Debian LTS Announcement December 2022 and the Debian LTS Announcement June 2025.
Rebuild and redeploy any statically linked applications or firmware images that bundle vulnerable Mbed TLS code.

Patch Information

Upstream fixes are available in the GitHub mbed TLS v2.16.12 Release, GitHub mbed TLS v2.28.0 Release, and GitHub mbed TLS v3.1.0 Release. Refer to the Mbed TLS Security Advisory 2021-12 for vendor guidance.

Workarounds

Restrict network exposure of TLS endpoints to trusted clients where patching is delayed.
Apply memory limits and rate limiting to prevent attackers from inducing the out-of-memory condition required to trigger the double free.
Disable TLS session caching or session reuse in configurations where the affected code path can be avoided until patches are applied.

bash

# Verify the installed Mbed TLS version on Debian-based systems
dpkg -l | grep -i mbedtls

# Upgrade Mbed TLS packages
sudo apt-get update
sudo apt-get install --only-upgrade libmbedtls-dev libmbedcrypto7 libmbedx509-1