// CVE · Published · NVD
FFDH key exchange lacks contributory-behaviour / peer-key validation, enabling protocol-level abuse. Found independently by Eva Crystal (0xiviel).
In finite-field Diffie-Hellman key agreement with PSA_ALG_FFDH, the built-in driver did not validate the peer’s public key the way RFC 7919 and NIST SP 800-56A require. A peer could send a public value outside the range [2, p-2], and the shared secret then collapsed into a small set of values chosen by that peer.
Loss of contributory behaviour: the shared secret no longer depends on both parties. How much that matters depends on the protocol around it. TLS 1.3 is not affected because the handshake transcript and random values still bind the key, but any custom use of FFDH is. NVD scores the record 9.1 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Found independently by Eva Crystal (0xiviel), XSource Security, and another reporter, as credited in the advisory.
Integer underflow of mlen in crypto_sign_open() in the CROSS reference implementation leads to a heap buffer overflow during signature verification.
Insufficient protection of serialized SSL session/context data can lead to memory-safety issues when restoring tampered or corrupted state. Credited jointly with Haruto Kimura (Stella).
Out-of-bounds read in mbedtls_ccm_finish(): an oversized tag_len in the multipart CCM API exposes adjacent CCM context data. Discovered through the Intigriti Trusted Firmware program.
Possible buffer overflow in mbedtls_ecdh_calc_secret() when the output buffer is too small - up to remote code execution.
