CVE-2024-28960

high

Description

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.

References

Advisories
More

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/

https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/

https://lists.fedoraproject.org/archives/list/[email protected]/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/

https://lists.fedoraproject.org/archives/list/[email protected]/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/

https://lists.fedoraproject.org/archives/list/[email protected]/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/

https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md

Details

Source: Mitre, NVD

Published: 2024-03-29

Updated: 2025-11-04

Risk Information

CVSS v2

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N

Severity: High

CVSS v3

Base Score: 8.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N