CVE-2024-28960: Arm Mbed Crypto Privilege Escalation Flaw

CVE-2024-28960 Overview

CVE-2024-28960 is a vulnerability in the Mbed TLS Platform Security Architecture (PSA) Crypto API that mishandles shared memory. The flaw affects Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8, and 3.x before 3.6.0, along with Mbed Crypto. The issue is categorized under [CWE-284] (Improper Access Control). An attacker who controls the contents of a shared memory buffer used as input or output to a PSA Crypto call can manipulate cryptographic operations during execution, undermining confidentiality and integrity guarantees expected from the cryptographic library.

Critical Impact
Attackers with access to shared memory regions used by the PSA Crypto API can read sensitive cryptographic material or influence cryptographic operations, breaking confidentiality and partial integrity assurances of the library.

Affected Products

Arm Mbed TLS 2.18.0 through 2.28.x before 2.28.8
Arm Mbed TLS 3.x before 3.6.0 and Arm Mbed Crypto
Fedora 38, 39, and 40 distributions shipping vulnerable Mbed TLS packages

Discovery Timeline

2024-03-29 - CVE-2024-28960 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2024-28960

Vulnerability Analysis

The Mbed TLS PSA Crypto API allows callers to pass input and output buffers to cryptographic operations such as encryption, decryption, signing, and key derivation. When these buffers reside in memory shared with an untrusted party, the library reads from and writes to the caller-owned memory multiple times during processing. The library does not copy data into a private working buffer before validation or use. An adversary with concurrent access to the shared region can modify the contents between the time-of-check and time-of-use, or observe intermediate values written by the library. This breaks the assumption that PSA Crypto input is stable for the duration of a call.

Root Cause

The root cause is improper access control [CWE-284] over shared memory used by the PSA Crypto API. The implementation trusts that buffer contents remain unchanged during processing and that no untrusted observer can read intermediate writes. In multi-tenant or sandboxed deployments where the crypto module sits across a security boundary from its caller, this assumption does not hold. The library lacks the defensive copy-in and copy-out pattern required for cross-boundary cryptographic APIs.

Attack Vector

The vulnerability is exploitable over the network attack surface when Mbed TLS is used in services that handle remote inputs and rely on shared memory between trust domains. Exploitation requires an attacker to control a process or component that shares a memory region with a PSA Crypto consumer. Typical scenarios involve Trusted Execution Environment (TEE) deployments, isolated crypto services, or virtualized environments where Mbed TLS executes in a separate domain from the requesting application. The attacker reads or rewrites the shared buffer concurrently with PSA Crypto processing to leak plaintext, extract key material, or steer operations toward attacker-chosen values. The vulnerability primarily threatens confidentiality, with limited integrity impact. See the Mbed TLS Security Advisory 2024-03 for the full technical description.

Detection Methods for CVE-2024-28960

Indicators of Compromise

Mbed TLS shared object or static library reporting a version between 2.18.0 and 2.28.7, or any 3.x release before 3.6.0
Fedora 38, 39, or 40 hosts with mbedtls packages predating the security update referenced in the Fedora package announcement
Applications loading libmbedcrypto.so from a vulnerable version while operating across a trust boundary

Detection Strategies

Inventory all binaries linked against libmbedtls, libmbedcrypto, or libmbedx509 and correlate their versions against the fixed releases 2.28.8 and 3.6.0
Audit code that invokes PSA Crypto APIs such as psa_cipher_*, psa_aead_*, psa_sign_*, and psa_key_derivation_* with buffers originating from shared memory, IPC, or untrusted callers
Use software composition analysis tooling on container images and firmware bundles to flag vulnerable Mbed TLS versions

Monitoring Recommendations

Track package manager events on Fedora and other Linux hosts for updates to mbedtls and related packages
Monitor TEE and secure enclave deployments for crypto service binaries that have not been recompiled against patched Mbed TLS
Alert on process behavior that maps or reads shared memory regions belonging to crypto service processes from unexpected callers

How to Mitigate CVE-2024-28960

Immediate Actions Required

Upgrade Mbed TLS to version 2.28.8 (LTS branch) or 3.6.0 or later across all systems and embedded firmware
Apply Fedora updates for mbedtls on Fedora 38, 39, and 40 hosts as published in the Fedora package announcements
Rebuild and redeploy any application or TEE component that statically links Mbed TLS or Mbed Crypto

Patch Information

The Mbed TLS maintainers addressed the issue in releases 2.28.8 and 3.6.0. The fixes are described in the Mbed TLS Security Advisory 2024-03 and tracked in the Mbed TLS Security Advisories index. Fedora 38, 39, and 40 received corresponding package updates documented in the Fedora package announcements.

Workarounds

Copy PSA Crypto input buffers from shared memory into process-private memory before invoking the API, and copy outputs back only after the call completes
Avoid exposing the PSA Crypto API across trust boundaries until patched libraries are deployed
Where possible, restrict the set of processes that can map memory regions used by Mbed TLS callers to limit the exploitable surface

bash

# Verify installed Mbed TLS version on Fedora hosts
rpm -q mbedtls

# Update to a patched release
sudo dnf upgrade --refresh mbedtls

# Confirm runtime library version after upgrade
strings /usr/lib64/libmbedcrypto.so | grep -i 'mbed TLS'