A critical vulnerability in Mbed TLS and TF-PSA-Crypto allows for the potential compromise of cryptographic integrity due to flawed PRNG seeding.

The vulnerability involves the misuse of seeds within the Pseudo-Random Number Generator, which can result in predictable random number generation. Based on the CVSS vector (AV:L/AC:L/PR:N/UI:N), the flaw is exploitable by an unauthenticated local attacker.

The compromise of a PRNG can lead to the successful decryption of sensitive traffic, the forgery of cryptographic signatures, or the bypass of authentication mechanisms that rely on secure random values. With a CVSS score of 7.7, this represents a high-severity risk that could lead to widespread data compromise and the loss of trust in secure communications.

Immediate Action: Update Mbed TLS to version 3.6.6 or later and TF-PSA-Crypto to version 1.1.0 or later to implement the corrected PRNG seeding logic.

Proactive Monitoring: Audit application logs for unusual cryptographic errors or repeated patterns in session identifiers that might indicate PRNG output analysis.

Compensating Controls: Ensure that systems relying on these libraries are isolated within secure environments to limit local access, as the vulnerability requires local access to trigger effectively.

Public Exploit Available: unknown

Given the central role of Mbed TLS in providing secure communications, this vulnerability poses a significant risk to the integrity of encrypted data. Organizations should prioritize updating to the specified fixed versions to ensure the strength of their cryptographic operations. Failure to remediate could leave systems vulnerable to sophisticated local attacks capable of bypassing security controls.