Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-24 17:43:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1555 from gilles-peskine-arm/ssl_tls13_prepare_new_session_ticket-psa_get_random-3.6

Browse Source 
Backport 3.6: Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure
This commit is contained in:
Ronald Cron
2026-05-29 16:19:37 +02:00
committed by GitHub
parent 14ff18114f 8b7af9d421
commit 4c70413087
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt
+5
View File
@@ -0,0 +1,5 @@
Security
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return
1 instead of an error code if the random generator failed when a server
called these functions before the end of a TLS 1.3 handshake.
Reported by Mohammad Seet (mhdsait101). CVE-2026-40294
library/ssl_tls13_server.c
+4 -3
View File
@@ -3204,9 +3204,10 @@ static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
#endif
/* Generate ticket_age_add */
if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
(unsigned char *) &session->ticket_age_add,
sizeof(session->ticket_age_add)) != 0)) {
ret = ssl->conf->f_rng(ssl->conf->p_rng,
(unsigned char *) &session->ticket_age_add,
sizeof(session->ticket_age_add));
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
return ret;
}