An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert).
When a TLS 1.3 server is configured with optional client authentication, the mbedtls_ssl_get_verify_result() function incorrectly returns a result without setting MBEDTLS_X509_BADCERT_KEY_USAGE flags, even if the client certificate contains incorrect or inappropriate values in the keyUsage or extKeyUsage extensions. As a result, the library does not reject a certificate that is not intended for TLS client authentication. An attacker possessing any valid X.509 certificate (e.g., issued for other purposes) can effectively use it to authenticate as a TLS 1.3 client. The vulnerability only affects configurations with optional authentication — in the case of required authentication, the handshake is interrupted with a critical alert.
An attacker can bypass the access control mechanism based on client certificates and authenticate to a TLS 1.3 server using a certificate not intended for this purpose, gaining unauthorized access to protected resources.
Arm Mbed TLS should be updated to version 3.6.1 or later. Details are available in the official security advisory from the vendor: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-3/. As a workaround, the server configuration can be changed to require client authentication (required authentication) instead of optional.
Arm Mbed TLS in versions 3.x before 3.6.1 — only TLS 1.3 servers configured with optional client authentication
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTrustedfirmware Mbed Tls
APPTrustedfirmware3.2.0 – 3.6.1 (excl.)
Related vulnerabilities
RCE przez deserializację kontekstu SSL w Mbed TLS
Arm Mbed TLS: podszywanie się pod klienta przy wznawianiu sesji TLS 1.3
Buffer overflow w eksporcie klucza publicznego FFDH w Mbed TLS i TF-PSA-Crypto
Buffer underrun w Mbed TLS podczas zapisu nieprzezroczystej pary kluczy
Stack buffer overflow w Mbed TLS – funkcje konwersji ECDSA