PT-2024-2509 · Arm+4 · Mbed Tls+5

Published 2024-03-25 · Updated 2026-05-05 · CVE-2024-28960

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8 Mbed TLS versions 3.x before 3.6.0 Mbed Crypto (affected versions not specified)

Description The PSA Crypto API in Mbed TLS and Mbed Crypto mishandles shared memory, which can be exploited to impact the confidentiality, integrity, and availability of data. The issue is related to insufficient spatial separation.

Recommendations For Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8, update to version 2.28.8 or later. For Mbed TLS versions 3.x before 3.6.0, update to version 3.6.0 or later. For Mbed Crypto, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the PSA Crypto API to minimize the risk of exploitation.

Improper Access Control

Weakness Enumeration

CWE-284

CWE-653

Related Identifiers

ALT-PU-2025-10462

AZL-47703

BDU:2024-02490

CVE-2024-28960

MGASA-2024-0146

OPENSUSE-SU-2024:13813-1

Affected Products

Alt Linux

Astra Linux

Debian

Mbed Crypto

Mbed Tls

Red Os

References · 42

• https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-28960 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28960 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13813-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0146.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28960 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2024-0905SE18MD · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0146 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28960 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28960 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28960 · Security Note