CVE-2025-49600
📋 TL;DR
This vulnerability in MbedTLS allows attackers to forge LMS signatures when using hardware-accelerated hashing. An attacker who can induce faults in hash accelerator hardware can bypass signature verification, potentially accepting invalid signatures. This affects systems using MbedTLS with LMS signatures and hardware hash acceleration.
💻 Affected Systems
- MbedTLS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of LMS signature verification allowing forged signatures to be accepted as valid, potentially compromising authentication, code signing, or secure boot mechanisms.
Likely Case
Limited impact requiring physical access or specialized hardware to induce faults, primarily affecting high-security environments using LMS signatures with hardware acceleration.
If Mitigated
Minimal impact when using software SHA-256 implementation or when hardware fault injection is prevented through physical security controls.
🎯 Exploit Status
Exploitation requires physical access or ability to induce hardware faults in hash accelerators, making it complex and targeted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.4
Vendor Advisory: https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-3.md
Restart Required: Yes
Instructions:
1. Download MbedTLS 3.6.4 or later from official repository. 2. Replace vulnerable version with patched version. 3. Recompile and relink applications using MbedTLS. 4. Restart affected services.
🔧 Temporary Workarounds
Disable hardware acceleration
allForce use of software SHA-256 implementation instead of hardware acceleration
Configure MbedTLS to use MBEDTLS_SHA256_ALT=0 in mbedtls_config.h
Disable LMS signatures
allDisable LMS signature functionality if not required
Set MBEDTLS_LMS_C=0 in mbedtls_config.h
🧯 If You Can't Patch
- Implement physical security controls to prevent hardware fault injection attacks
- Monitor for unusual signature verification failures or anomalies in LMS signature operations
🔍 How to Verify
Check if Vulnerable:
Check MbedTLS version with: mbedtls_version -v or examine source code for version 3.3.0-3.6.3Check Version:
mbedtls_version -vVerify Fix Applied:
Verify version is 3.6.4 or later and check that return values are properly checked in mbedtls_lms_verify function📡 Detection & Monitoring
Log Indicators:
- Unexpected LMS signature verification successes
- Hash computation failures in hardware acceleration
Network Indicators:
- Unusual signature patterns in LMS-signed communications
SIEM Query:
Search for: ("mbedtls_lms_verify" AND "signature accepted") OR ("hardware hash" AND "failure")