CVE-2024-28960
📋 TL;DR
This vulnerability in Mbed TLS and Mbed Crypto allows attackers to potentially access sensitive cryptographic data or cause denial of service through improper handling of shared memory in the PSA Crypto API. It affects systems using vulnerable versions of these cryptographic libraries, particularly those implementing PSA Crypto functionality.
💻 Affected Systems
- Mbed TLS
- Mbed Crypto
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of cryptographic operations leading to data exposure, authentication bypass, or system crashes affecting availability.
Likely Case
Information disclosure of cryptographic keys or other sensitive data, potentially enabling further attacks on encrypted communications.
If Mitigated
Limited impact with proper memory isolation and access controls, potentially only causing localized crashes.
🎯 Exploit Status
Exploitation requires specific conditions related to PSA Crypto API usage and shared memory operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Mbed TLS 2.28.8 or 3.6.0
Vendor Advisory: https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
Restart Required: Yes
Instructions:
1. Identify affected Mbed TLS version. 2. Update to Mbed TLS 2.28.8 or 3.6.0. 3. Recompile applications using the library. 4. Restart affected services.
🔧 Temporary Workarounds
Disable PSA Crypto API
allIf PSA Crypto API is not required, disable it during compilation to remove the vulnerable code path.
Configure with -DMBEDTLS_PSA_CRYPTO_C=OFF during build
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to affected systems
- Monitor for unusual memory access patterns or cryptographic operation failures
🔍 How to Verify
Check if Vulnerable:
Check Mbed TLS version and PSA Crypto API usage. Vulnerable if using Mbed TLS 2.18.0-2.28.7 or 3.0.0-3.5.x with PSA Crypto enabled.Check Version:
Check library version in application or use: strings /path/to/library | grep -i mbedVerify Fix Applied:
Verify Mbed TLS version is 2.28.8 or higher, or 3.6.0 or higher, and confirm PSA Crypto API is properly configured.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes related to cryptographic operations
- Memory access violation errors in PSA Crypto context
Network Indicators:
- Abnormal TLS handshake failures
- Unexpected termination of encrypted connections
SIEM Query:
Search for process crashes with mbedtls or cryptographic library components, or failed TLS connections from systems using Mbed TLS🔗 References
- https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/
- https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
- https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/
- https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
