Executive brief
Mbed TLS is a widely used library that provides cryptographic and SSL/TLS capabilities for embedded devices. A vulnerability in its signature verification process could allow an attacker with physical access to the device to bypass security checks. By interfering with the device's hardware during a calculation, an attacker could trick the system into accepting a forged digital signature, potentially allowing unauthorized software or commands to be executed.
Technical details
A vulnerability exists in the mbedtls_lms_verify() function due to unchecked return values from internal Merkle tree functions, specifically create_merkle_leaf_value() and create_merkle_internal_value(). When hardware-accelerated hashing is used, an attacker can use physical fault injection to cause these functions to fail. Because the return values are not validated, the output buffer (Tc_candidate_root_node) may remain uninitialized or contain stale data from a previous successful verification. This allows an attacker to bypass signature verification by reusing valid root node data remaining on the stack. The issue is resolved in Mbed TLS 3.6.4.
Affected products
- TrustedFirmware Mbed TLS 3.3.0 to 3.6.3
Timeline
- 2025-06-30: advisory: Original security advisory date
- 2025-07-04: disclosed: NVD publication date