CVE-2025-27810

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Root has patched CVE-2025-27810 in the mbedtls package for Root:Debian:12. Multiple fixed versions available.

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

These are all security issues fixed in the libmbedcrypto7-2.28.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mbedtls fixes the following issues:

Changes in mbedtls:

• Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes accumulated across the 3.6.2-3.6.6 releases:
  • CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair
  • CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames
  • CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors
  • CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names()
  • CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data()
  • CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal
  • CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection
  • CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key()
  • CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery
  • CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material
  • CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
  • CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting
  • CVE-2026-25833: PSA RNG state duplicated across fork()
  • CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade
  • CVE-2026-25835: RNG state duplicated when application/VM state is cloned

This update for mbedtls-2 fixes the following issues:

Changes in mbedtls-2:

• Enable SRTP and DTLS protocols needed by some software.

• Update to version 2.28.10: Default behavior changes

  • In TLS clients, if mbedtls_ssl_set_hostname() has not been called, mbedtls_ssl_handshake() now fails with MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if certificate-based authentication of the server is attempted. This is because authenticating a server without knowing what name to expect is usually insecure. To restore the old behavior, either call mbedtls_ssl_set_hostname() with NULL as the hostname, or enable the new compile-time option MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. The content of ssl->hostname after mbedtls_ssl_set_hostname(ssl, NULL) has changed, see the documentation of the hostname field in the mbedtls_ssl_context struct type for details. Security
  • Note that TLS clients should generally call mbedtls_ssl_set_hostname() if they use certificate authentication (i.e. not pre-shared keys). Otherwise, in many scenarios, the server could be impersonated. The library will now prevent the handshake and return MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if mbedtls_ssl_set_hostname() has not been called. CVE-2025-27809 (boo#1240051)
  • Zeroize temporary heap buffers used in PSA operations.
  • Fix a vulnerability in the TLS 1.2 handshake. If memory allocation failed or there was a cryptographic hardware failure when calculating the Finished message, it could be calculated incorrectly. This would break the security guarantees of the TLS handshake. CVE-2025-27810 (boo#1240052) Bugfix
  • Use 'mbedtls_net_close' instead of 'close' in 'mbedtls_net_bind' and 'mbedtls_net_connect' to prevent possible double close fd problems. Fixes gh#Mbed-TLS/mbedtls#9711.
  • Fix compilation on MS-DOS DJGPP. Fixes gh#Mbed-TLS/mbedtls#9813.
  • Fix missing constraints on the AES-NI inline assembly which is used on GCC-like compilers when building AES for generic x86_64 targets. This may have resulted in incorrect code with some compilers, depending on optimizations. Fixes gh#Mbed-TLS/mbedtls#9819.
  • Fix issue where psa_key_derivation_input_integer() is not detecting bad state after an operation has been aborted.
  • Fix definition of MBEDTLS_PRINTF_SIZET to prevent runtime crashes that occurred whenever SSL debugging was enabled on a copy of Mbed TLS built with Visual Studio 2013 or MinGW. Fixes gh#Mbed-TLS/mbedtls#10017.
  • Remove Everest Visual Studio 2010 compatibility headers, which could shadow standard CRT headers inttypes.h and stdbool.h with incomplete implementatios if placed on the include path, eg. when building Mbed TLS with the .sln file shipped with the project.

It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could possibly use this issue to crash the program. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-44732)

Jonathan Winzig discovered that Mbed TLS incorrectly handled crafted inputs. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS. (CVE-2024-23775)

It was discovered that Mbed TLS incorrectly handled the TLS handshake. A remote attacker could possibly use this issue to break the security guarantees of the TLS handshake. (CVE-2025-27810)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly documented the behavior of a function. Application code relying on the documented behavior might be affected. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2025-47917)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-48965)

It was discovered that Mbed TLS incorrectly handled a race condition. An attacker could possibly use this issue to extract AES keys. (CVE-2025-52496)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled certain invalid input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-52497)