CVE-2025-59438

A vulnerability in Mbed TLS (versions 2.19.0 to 3.6.5 and 4.0.0) is caused by insufficient protection of serialized SSL structures. An attacker can modify these structures, leading to memory corruption and potential arbitrary code execution.

In the Mbed TLS crypto shim driver (drivers/crypto/crypto_mbedtls_shim.c), error paths in mbedtls_cbc() and mbedtls_aead() after a successful psa_cipher_encrypt_setup()/psa_aead_decrypt_setup() return without calling psa_cipher_abort()/psa_aead_abort(). This permanently leaks the heap-allocated mbedtls_aes_context (about 288 bytes) from Mbed TLS's fixed static heap (default 512 bytes) on each failed operation. An unauthenticated attacker can exhaust the heap by sending 802.15.4 frames with a bogus MIC or via the OSDP channel, permanently breaking subsequent cryptographic operations until reboot.

In Mbed TLS 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts a HelloRetryRequest selecting a group that was not advertised. This can violate TLS 1.3 protocol negotiation expectations.

Mbed TLS 3.x before 3.6.6 has an out-of-bounds read vulnerability in mbedtls_ccm_finish() due to missing validation of the tag_len parameter. An attacker can obtain adjacent CCM context data.

In Mbed TLS through 4.0.0, a compiler-induced timing side channel (in RSA and CBC/ECB decryption) occurs only with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. An attacker with local access may exploit timing differences to extract information about cryptographic operations.