CVE-2024-45159: Arm Mbed TLS Auth Bypass Vulnerability

CVE-2024-45159 Overview

CVE-2024-45159 is a certificate validation bypass vulnerability affecting Mbed TLS 3.x versions prior to 3.6.1. The flaw occurs within TLS 1.3 implementations when a server enables optional client authentication. When a client presents a certificate that lacks appropriate values in the keyUsage or extKeyUsage extensions, the mbedtls_ssl_get_verify_result() function incorrectly clears the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE error bits. This improper certificate validation allows an attacker to leverage certificates intended for other purposes (such as code signing or email encryption) for TLS client authentication.

Critical Impact
An attacker with a certificate valid for non-TLS purposes can bypass authentication controls and successfully authenticate as a client to affected TLS 1.3 servers, potentially gaining unauthorized access to protected resources.

Affected Products

Arm Mbed TLS 3.x versions before 3.6.1

Discovery Timeline

2024-09-05 - CVE-2024-45159 published to NVD
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-45159

Vulnerability Analysis

This vulnerability stems from improper certificate validation logic within the Mbed TLS library's TLS 1.3 implementation. The core issue lies in how the library evaluates X.509 certificate extensions during the client authentication process. X.509 certificates contain keyUsage and extKeyUsage extensions that specify the intended purposes for which the certificate can be used—such as digital signature, key encipherment, client authentication, or code signing.

When a TLS 1.3 server performs optional client authentication and receives a client certificate, it should verify that the certificate explicitly permits TLS client authentication. However, due to a bug in mbedtls_ssl_get_verify_result(), even when a certificate lacks proper key usage values for TLS client authentication, the function incorrectly reports that no key usage violations occurred. This creates a situation where the server accepts certificates that should be rejected.

The vulnerability specifically affects servers configured with optional client authentication. When required authentication is enabled, the handshake properly fails with a fatal alert upon encountering invalid certificates. This behavioral difference indicates the bug exists specifically in the optional authentication code path.

Root Cause

The root cause is an improper certificate validation flaw (CWE-295) in the return value handling of mbedtls_ssl_get_verify_result(). The function fails to properly set the MBEDTLS_X509_BADCERT_KEY_USAGE error flags when certificate extensions do not meet TLS client authentication requirements under the optional authentication configuration. This represents an incorrect status bit clearing operation that masks legitimate validation failures from the calling application.

Attack Vector

The attack requires network access to a vulnerable TLS 1.3 server configured with optional client authentication. An attacker who possesses any valid X.509 certificate—even one explicitly intended for purposes other than TLS client authentication—can present this certificate during the TLS handshake. The vulnerable server will incorrectly accept this certificate as valid for client authentication, allowing the attacker to establish an authenticated session.

The exploitation scenario involves:

The attacker obtains a valid X.509 certificate with proper signatures but improper keyUsage or extKeyUsage values for TLS client authentication (e.g., a code signing certificate or S/MIME certificate)
The attacker initiates a TLS 1.3 connection to a vulnerable Mbed TLS server with optional client authentication enabled
When prompted for client authentication, the attacker presents their certificate
The server's mbedtls_ssl_get_verify_result() incorrectly clears the key usage error bits
The server accepts the certificate, granting the attacker authenticated access

This attack does not require user interaction and can be executed remotely against any exposed vulnerable server.

Detection Methods for CVE-2024-45159

Indicators of Compromise

Successful TLS 1.3 client authentications from clients presenting certificates with non-TLS authentication key usage extensions
Certificate validation logs showing accepted certificates with keyUsage values inconsistent with client authentication
Unexpected client certificate subjects or issuers appearing in server authentication logs
Anomalous access patterns from previously unknown client certificates

Detection Strategies

Audit TLS handshake logs for client certificates that lack clientAuth in their extKeyUsage extension
Implement secondary certificate validation checks at the application layer to verify key usage extensions
Monitor for authentication events involving certificates with unusual or unexpected purposes
Compare accepted client certificates against a whitelist of known-good certificates

Monitoring Recommendations

Enable verbose TLS handshake logging to capture full certificate chain details during client authentication
Implement alerting on client authentication from certificates not previously registered in your certificate inventory
Review Mbed TLS version deployments across your infrastructure to identify vulnerable installations
Correlate authentication events with application access logs to detect potential unauthorized access

How to Mitigate CVE-2024-45159

Immediate Actions Required

Upgrade Mbed TLS to version 3.6.1 or later immediately on all affected systems
If immediate patching is not possible, consider temporarily switching to required client authentication mode instead of optional
Audit systems for any signs of unauthorized client certificate authentication
Review all accepted client certificates for proper keyUsage and extKeyUsage values

Patch Information

Arm has released Mbed TLS version 3.6.1 which addresses this vulnerability. The update corrects the certificate validation logic in mbedtls_ssl_get_verify_result() to properly report key usage violations when certificates lack appropriate TLS client authentication extensions. Organizations should obtain the patched version from the GitHub MbedTLS Releases page. Additional details about this vulnerability are available in the MbedTLS Security Advisory 2024-08-3.

Workarounds

Configure TLS 1.3 servers to use required client authentication instead of optional authentication, which causes the handshake to properly fail with a fatal alert upon invalid certificates
Implement application-level certificate validation that independently verifies keyUsage and extKeyUsage extensions after the TLS handshake
Restrict client certificate issuers to a limited set of trusted certificate authorities with strict issuance policies for TLS client authentication certificates
Consider temporarily disabling client authentication entirely if it is not operationally critical until patching is completed

Administrators should verify Mbed TLS version and authentication configuration:

bash

# Check installed Mbed TLS version
mbedtls_version

# Review TLS configuration for optional client authentication settings
grep -r "MBEDTLS_SSL_VERIFY_OPTIONAL" /etc/mbedtls/ /usr/local/etc/mbedtls/

# Verify upgrade to patched version
dpkg -l | grep mbedtls
# Or for source builds, check the version header
grep "MBEDTLS_VERSION_STRING" /usr/local/include/mbedtls/build_info.h