The vulnerability exists in the function tls_opt_dtls_peer_connection_id_value_get() in Zephyr's sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE). The function passes the caller-supplied buffer directly to mbedtls_ssl_get_peer_cid() without verifying that the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32 bytes). Since mbedtls_ssl_get_peer_cid() copies the peer's DTLS Connection ID into the buffer without a size parameter, a smaller buffer causes a write overflow of up to 31 bytes past the buffer end. In CONFIG_USERSPACE builds, the syscall verifier allocates exactly optlen bytes in kernel space, so an unprivileged user can cause a kernel-heap buffer overflow by passing a small optlen on a connected DTLS socket with Connection ID enabled. The vulnerability was introduced in version 3.5.0 when the TLS_DTLS_CID option was added. The fix implemented rejects calls with optlen smaller than MBEDTLS_SSL_CID_OUT_LEN_MAX with an error code -EINVAL.

An unprivileged user thread can trigger a kernel-heap buffer overflow by passing a small optlen value on a connected DTLS socket with Connection ID enabled. This overflow writes up to 31 bytes past the allocated buffer in kernel space, potentially leading to kernel memory corruption. The vulnerability has no confidentiality impact but can cause high integrity and availability impact due to kernel memory corruption. Exploitation requires specific kernel configuration (CONFIG_USERSPACE), the DTLS Connection ID feature enabled (CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID), and an established DTLS session with a negotiated peer CID.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects calls with optlen smaller than MBEDTLS_SSL_CID_OUT_LEN_MAX, returning -EINVAL. Until an official fix is confirmed, avoid enabling CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID or restrict unprivileged user access to DTLS sockets. Monitor vendor channels for patch releases and apply updates promptly once available.