CVE-2024-28960

What it actually does

The PSA Crypto API in affected Mbed TLS versions fails to properly isolate shared memory regions, enabling unauthorized reads of sensitive cryptographic material such as keys or intermediate values.

Why it matters to the business

Systems relying on the library for secure operations face exposure of cryptographic secrets that could undermine encrypted communications, authentication, and data protection controls across embedded and server deployments.

How an attack unfolds

An attacker sends crafted requests that exercise the PSA Crypto API over the network, triggering the shared-memory mishandling to read protected data that should remain inaccessible.

How to fix it

Upgrade armmbed/mbedtls to the commit 2ca6c285a0dd3f33982dd57299012dacab1ff206 (equivalent to 2.28.8 or 3.6.0) and update tomcat (Bitnami) to 8.5.76 or later.

How to confirm the fix worked

Confirm the running Mbed TLS version meets or exceeds the fixed releases, then exercise PSA Crypto operations while verifying that shared-memory regions no longer leak protected data.

Typical attack path

1. Locate services exposing the vulnerable Mbed TLS PSA Crypto API
2. Issue API calls that interact with shared memory buffers
3. Observe or exfiltrate cryptographic material leaked through the mishandled memory

How to detect it

Review application and library logs for PSA Crypto API invocations that coincide with unexpected memory access or data leakage patterns; examine process memory dumps for anomalous shared-buffer contents.

What your security team should do

• Apply the listed fixed versions to all instances of the library
• Audit applications that invoke the PSA Crypto API for shared-memory usage patterns
• Re-test cryptographic flows after patching to confirm isolation