CVE-2024-45157

What it actually does

Mbed TLS PSA subsystem ignores the user-selected HMAC_DRBG algorithm configured via MBEDTLS_PSA_HMAC_DRBG_MD_TYPE and instead falls back to CTR_DRBG unless both MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled, causing the documented random-number generator to be bypassed.

Why it matters to the business

Cryptographic operations that rely on the configured DRBG may silently use a different generator, raising the risk of reduced entropy or predictability in keys and nonces on affected embedded devices and increasing exposure of sensitive data.

How an attack unfolds

An attacker with local access crafts inputs or observes outputs that depend on random values generated under the misconfigured PSA subsystem; when the fallback CTR_DRBG is used instead of the intended HMAC_DRBG the resulting values may exhibit statistical bias or lower entropy that the attacker can leverage to recover keys or forge tokens.

How to fix it

Upgrade Mbed TLS to version 2.28.9 or 3.6.1 (commit 71c569d44bf3a8bd53d874c81ee8ac644dd6e9e3). After upgrading, rebuild with the intended DRBG configuration and re-verify that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE now correctly selects HMAC_DRBG under the documented conditions.

How to confirm the fix worked

Inspect the compiled library version string or build configuration; confirm that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE is set and that the PSA random generator selection logic matches the updated documentation. Run regression tests that exercise PSA random APIs and assert the expected DRBG type is active.

Typical attack path

1. Identify target systems running Mbed TLS versions before 2.28.9 or 3.6.1 with MBEDTLS_PSA_HMAC_DRBG_MD_TYPE enabled.
2. Confirm that MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are not both disabled so the fallback occurs.
3. Trigger cryptographic operations that consume randomness from the PSA subsystem.
4. Collect or influence outputs that depend on the generated values and attempt to recover secrets or bypass protections.

How to detect it

Search build logs, configuration headers, and binary strings for MBEDTLS_PSA_HMAC_DRBG_MD_TYPE combined with the absence of both MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C; review application logs for cryptographic operations that rely on PSA random generation to identify potential misuse of the fallback generator.

What your security team should do

• Prioritize upgrade of all Mbed TLS instances to the fixed releases within the next maintenance window.
• Audit build configurations to ensure the documented DRBG selection behavior is achieved after the update.
• Add version checks for Mbed TLS to continuous integration and dependency scanners.
• Review any downstream products that embed Mbed TLS for the same configuration exposure.