CVE-2024-45159: Arm Mbed TLS Auth Bypass Vulnerability

CVE-2024-45159 Overview

CVE-2024-45159 is a certificate validation bypass vulnerability affecting Mbed TLS 3.x versions prior to 3.6.1. The flaw occurs within TLS 1.3 implementations when a server enables optional client authentication. When a client presents a certificate that lacks appropriate values in the keyUsage or extKeyUsage extensions, the mbedtls_ssl_get_verify_result() function incorrectly clears the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE error bits. This improper certificate validation allows an attacker to leverage certificates intended for other purposes (such as code signing or email encryption) for TLS client authentication.

Critical Impact

An attacker with a certificate valid for non-TLS purposes can bypass authentication controls and successfully authenticate as a client to affected TLS 1.3 servers, potentially gaining unauthorized access to protected resources.

Affected Products

• Arm Mbed TLS 3.x versions before 3.6.1

Discovery Timeline

• 2024-09-05 - CVE-2024-45159 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-45159

Vulnerability Analysis

This vulnerability stems from improper certificate validation logic within the Mbed TLS library's TLS 1.3 implementation. The core issue lies in how the library evaluates X.509 certificate extensions during the client authentication process. X.509 certificates contain keyUsage and extKeyUsage extensions that specify the intended purposes for which the certificate can be used—such as digital signature, key encipherment, client authentication, or code signing.

When a TLS 1.3 server performs optional client authentication and receives a client certificate, it should verify that the certificate explicitly permits TLS client authentication. However, due to a bug in mbedtls_ssl_get_verify_result(), even when a certificate lacks proper key usage values for TLS client authentication, the function incorrectly reports that no key usage violations occurred. This creates a situation where the server accepts certificates that should be rejected.

The vulnerability specifically affects servers configured with optional client authentication. When required authentication is enabled, the handshake properly fails with a fatal alert upon encountering invalid certificates. This behavioral difference indicates the bug exists specifically in the optional authentication code path.

Root Cause

The root cause is an improper certificate validation flaw (CWE-295) in the return value handling of mbedtls_ssl_get_verify_result(). The function fails to properly set the MBEDTLS_X509_BADCERT_KEY_USAGE error flags when certificate extensions do not meet TLS client authentication requirements under the optional authentication configuration. This represents an incorrect status bit clearing operation that masks legitimate validation failures from the calling application.

Attack Vector

The attack requires network access to a vulnerable TLS 1.3 server configured with optional client authentication. An attacker who possesses any valid X.509 certificate—even one explicitly intended for purposes other than TLS client authentication—can present this certificate during the TLS handshake. The vulnerable server will incorrectly accept this certificate as valid for client authentication, allowing the attacker to establish an authenticated session.

The exploitation scenario involves:

1. The attacker obtains a valid X.509 certificate with proper signatures but improper keyUsage or extKeyUsage values for TLS client authentication (e.g., a code signing certificate or S/MIME certificate)
2. The attacker initiates a TLS 1.3 connection to a vulnerable Mbed TLS server with optional client authentication enabled
3. When prompted for client authentication, the attacker presents their certificate
4. The server's mbedtls_ssl_get_verify_result() incorrectly clears the key usage error bits
5. The server accepts the certificate, granting the attacker authenticated access

This attack does not require user interaction and can be executed remotely against any exposed vulnerable server.

Detection Methods for CVE-2024-45159

Indicators of Compromise

• Successful TLS 1.3 client authentications from clients presenting certificates with non-TLS authentication key usage extensions
• Certificate validation logs showing accepted certificates with keyUsage values inconsistent with client authentication
• Unexpected client certificate subjects or issuers appearing in server authentication logs
• Anomalous access patterns from previously unknown client certificates

Detection Strategies

• Audit TLS handshake logs for client certificates that lack clientAuth in their extKeyUsage extension
• Implement secondary certificate validation checks at the application layer to verify key usage extensions
• Monitor for authentication events involving certificates with unusual or unexpected purposes
• Compare accepted client certificates against a whitelist of known-good certificates

Monitoring Recommendations

• Enable verbose TLS handshake logging to capture full certificate chain details during client authentication
• Implement alerting on client authentication from certificates not previously registered in your certificate inventory
• Review Mbed TLS version deployments across your infrastructure to identify vulnerable installations
• Correlate authentication events with application access logs to detect potential unauthorized access

How to Mitigate CVE-2024-45159

Immediate Actions Required

• Upgrade Mbed TLS to version 3.6.1 or later immediately on all affected systems
• If immediate patching is not possible, consider temporarily switching to required client authentication mode instead of optional
• Audit systems for any signs of unauthorized client certificate authentication
• Review all accepted client certificates for proper keyUsage and extKeyUsage values

Patch Information

Arm has released Mbed TLS version 3.6.1 which addresses this vulnerability. The update corrects the certificate validation logic in mbedtls_ssl_get_verify_result() to properly report key usage violations when certificates lack appropriate TLS client authentication extensions. Organizations should obtain the patched version from the GitHub MbedTLS Releases page. Additional details about this vulnerability are available in the MbedTLS Security Advisory 2024-08-3.

Workarounds

• Configure TLS 1.3 servers to use required client authentication instead of optional authentication, which causes the handshake to properly fail with a fatal alert upon invalid certificates
• Implement application-level certificate validation that independently verifies keyUsage and extKeyUsage extensions after the TLS handshake
• Restrict client certificate issuers to a limited set of trusted certificate authorities with strict issuance policies for TLS client authentication certificates
• Consider temporarily disabling client authentication entirely if it is not operationally critical until patching is completed

Administrators should verify Mbed TLS version and authentication configuration:

# Check installed Mbed TLS version
mbedtls_version

# Review TLS configuration for optional client authentication settings
grep -r "MBEDTLS_SSL_VERIFY_OPTIONAL" /etc/mbedtls/ /usr/local/etc/mbedtls/

# Verify upgrade to patched version
dpkg -l | grep mbedtls
# Or for source builds, check the version header
grep "MBEDTLS_VERSION_STRING" /usr/local/include/mbedtls/build_info.h