Executive brief
Mbed TLS and TF-PSA-Crypto are widely used cryptographic libraries that provide secure communication and data protection for embedded devices and applications. A vulnerability in these libraries could allow different instances of an application (such as those created by cloning a virtual machine or using the fork command) to generate identical random numbers, including security keys and nonces. This could allow an attacker to predict sensitive cryptographic values, potentially leading to the decryption of private data or the impersonation of legitimate users.
Technical details
The vulnerability (CWE-335) exists in the PSA subsystem of Mbed TLS and TF-PSA-Crypto because the internal random generator does not automatically reseed or provide an interface to force a reseed after a 'cloning' event. Cloning occurs during Unix fork() calls, virtual machine snapshots, or hibernation resumes, resulting in multiple instances sharing the same PRNG state. Consequently, these instances generate identical random sequences (keys, nonces, etc.), which can be exploited by an attacker to recover session keys or predict future outputs. The fix introduces automatic reseeding on Unix-like systems via fork protection and provides new APIs (psa_random_reseed) for manual control in other cloning scenarios. Affected versions include Mbed TLS 2.18.0 through 3.6.5 and 4.0.0, and TF-PSA-Crypto 1.0.0.
Affected products
- Arm Mbed TLS 2.18.0 to 3.6.5, 4.0.0
- Arm TF-PSA-Crypto 1.0.0
- Arm Mbed Crypto All versions
Timeline
- 2026-03-31: advisory: Vendor advisory published by Mbed TLS team
- 2026-04-01: disclosed: CVE-2026-25835 published
- 2026-06-01: other: NVD last modified date