CVE-2021-45450: High severity Arm mbed TLS vulnerability
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psaciphergenerateiv and psacipherencrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-45450?
CVE-2021-45450 is a vulnerability in Mbed TLS before 2.28.0 and 3.x before 3.1.0 that allows policy bypass or oracle-based decryption.
What is the severity of CVE-2021-45450?
The severity of CVE-2021-45450 is high, with a CVSS score of 7.5.
How does CVE-2021-45450 affect ARM mbed TLS?
CVE-2021-45450 affects ARM mbed TLS versions before 2.28.0 and 3.x before 3.1.0.
How can CVE-2021-45450 be exploited?
CVE-2021-45450 can be exploited by an untrusted application gaining access to memory locations containing the output buffer of the psa_cipher_generate_iv and psa_cipher_encrypt functions.
How can I fix CVE-2021-45450?
To fix CVE-2021-45450, update Mbed TLS to version 2.28.0 or later for the 2.x branch or version 3.1.0 or later for the 3.x branch.