Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lwip-tcpip/lwip

              master @ 3d896ba
            

Fixes

CVEs

CRITICAL

Peak severity

41.2%

Coverage

Highlights

Buffer Overflow: 10 prior fixes. Scrutinize any change in this area.

src/apps/altcp_tls/altcp_tls_mbedtls.c: most-fixed (8 issues). Treat as high-risk during review.

32 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Buffer Overflow: Multiple fixes address TLS send buffer size miscalculation and record expansion, leading to write past internal buffers. The component also had use-after-free/double-free issues, indicating fragile connection lifecycle management.

Use-After-Free: Recurring use-after-free/double-free in TLS connection teardown, especially when close/recv callbacks interact. Multiple fixes restructured callback handling and inner connection freeing, showing a persistent lifecycle hazard.

Buffer Overflow: TCP option parsing had multiple out-of-bounds read/overflow issues due to missing bounds checks and an undersized index variable. This is a remote, unauthenticated attack surface.