From 6712bd07b3ef2cfd767416e5725e4d3e384b6365 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Wed, 25 Feb 2026 08:40:28 +0100 Subject: [PATCH 1/6] Add warning in mbedtls_ssl_context_save/load documentation Signed-off-by: Ronald Cron --- include/mbedtls/ssl.h | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index a81bb686e3..530a6cb694 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -5570,6 +5570,27 @@ void mbedtls_ssl_free(mbedtls_ssl_context *ssl); * * \see mbedtls_ssl_context_load() * + * \warning The serialized data contains highly sensitive material, + * including the master secret from which the session's traffic + * keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_context_save() and + * mbedtls_ssl_context_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * A breach of confidentiality could result in full compromise + * of the associated TLS session, including loss of + * confidentiality and integrity of past and future + * application data protected under that session. + * + * A breach of integrity may allow modification of the + * serialized data prior to restoration. As it represents + * trusted internal context, tampering could potentially result + * in arbitrary code execution or other severe compromise of + * the hosting process. + * \note The serialized data only contains the data that is * necessary to resume the connection: negotiated protocol * options, session identifier, keys, etc. @@ -5636,6 +5657,27 @@ int mbedtls_ssl_context_save(mbedtls_ssl_context *ssl, * more than one context would cause severe security failures * including but not limited to loss of confidentiality. * + * \warning The serialized data contains highly sensitive material, + * including the master secret from which the session's traffic + * keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_context_save() and + * mbedtls_ssl_context_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * A breach of confidentiality could result in full compromise + * of the associated TLS session, including loss of + * confidentiality and integrity of past and future + * application data protected under that session. + * + * A breach of integrity may allow modification of the + * serialized data prior to restoration. As it represents + * trusted internal context, tampering could potentially result + * in arbitrary code execution or other severe compromise of + * the hosting process. + * * \note Before calling this function, the SSL context must be * prepared in one of the two following ways. The first way is * to take a context freshly initialised with From dd20b0644a9556fe8f4dd76cc1207798f356d13d Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Wed, 25 Feb 2026 09:04:08 +0100 Subject: [PATCH 2/6] Add warning in mbedtls_ssl_session_load/save documentation Signed-off-by: Ronald Cron --- include/mbedtls/ssl.h | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 530a6cb694..75911c7e00 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -3357,6 +3357,27 @@ int mbedtls_ssl_set_session(mbedtls_ssl_context *ssl, const mbedtls_ssl_session * On server, this can be used for alternative implementations * of session cache or session tickets. * + * \warning The serialized data contains highly sensitive material, + * including a resumption key (TLS 1.3) or the master secret + * (TLS 1.2) from which the session's traffic keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_session_save() and + * mbedtls_ssl_session_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * A breach of confidentiality could result in full compromise + * of the associated TLS session, including loss of + * confidentiality and integrity of past and future + * application data protected under that session. + * + * A breach of integrity may allow modification of the + * serialized data prior to restoration. As it represents + * trusted internal context, tampering could potentially result + * in arbitrary code execution or other severe compromise of + * the hosting process. + * * \warning If a peer certificate chain is associated with the session, * the serialized state will only contain the peer's * end-entity certificate and the result of the chain @@ -3395,6 +3416,27 @@ int mbedtls_ssl_session_load(mbedtls_ssl_session *session, * * \see mbedtls_ssl_session_load() * + * \warning The serialized data contains highly sensitive material, + * including a resumption key (TLS 1.3) or the master secret + * (TLS 1.2) from which the session's traffic keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_session_save() and + * mbedtls_ssl_session_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * A breach of confidentiality could result in full compromise + * of the associated TLS session, including loss of + * confidentiality and integrity of past and future + * application data protected under that session. + * + * A breach of integrity may allow modification of the + * serialized data prior to restoration. As it represents + * trusted internal context, tampering could potentially result + * in arbitrary code execution or other severe compromise of + * the hosting process. + * * \param session The session structure to be saved. * \param buf The buffer to write the serialized data to. It must be a * writeable buffer of at least \p buf_len bytes, or may be \c From e7c9b1dfb3cb825fbbb6389236e840a657d52c12 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Wed, 25 Feb 2026 18:56:12 +0100 Subject: [PATCH 3/6] Reduce duplication between save/load documentations Signed-off-by: Ronald Cron --- include/mbedtls/ssl.h | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 75911c7e00..43d8175988 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -3426,16 +3426,8 @@ int mbedtls_ssl_session_load(mbedtls_ssl_session *session, * mbedtls_ssl_session_load() APIs to ensure both its * confidentiality and integrity while stored or transported. * - * A breach of confidentiality could result in full compromise - * of the associated TLS session, including loss of - * confidentiality and integrity of past and future - * application data protected under that session. - * - * A breach of integrity may allow modification of the - * serialized data prior to restoration. As it represents - * trusted internal context, tampering could potentially result - * in arbitrary code execution or other severe compromise of - * the hosting process. + * See the mbedtls_ssl_session_load() documentation for + * additional information. * * \param session The session structure to be saved. * \param buf The buffer to write the serialized data to. It must be a @@ -5622,17 +5614,9 @@ void mbedtls_ssl_free(mbedtls_ssl_context *ssl); * mbedtls_ssl_context_load() APIs to ensure both its * confidentiality and integrity while stored or transported. * - * A breach of confidentiality could result in full compromise - * of the associated TLS session, including loss of - * confidentiality and integrity of past and future - * application data protected under that session. + * See the mbedtls_ssl_context_load() documentation for + * additional information. * - * A breach of integrity may allow modification of the - * serialized data prior to restoration. As it represents - * trusted internal context, tampering could potentially result - * in arbitrary code execution or other severe compromise of - * the hosting process. - * \note The serialized data only contains the data that is * necessary to resume the connection: negotiated protocol * options, session identifier, keys, etc. From e7076b1639112198be2a551ad9bb50a8a0773183 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Mon, 16 Mar 2026 11:05:21 +0100 Subject: [PATCH 4/6] Add change log Signed-off-by: Ronald Cron --- ChangeLog.d/context_load_and_session_load_documentation.txt | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 ChangeLog.d/context_load_and_session_load_documentation.txt diff --git a/ChangeLog.d/context_load_and_session_load_documentation.txt b/ChangeLog.d/context_load_and_session_load_documentation.txt new file mode 100644 index 0000000000..f7c1d27f8e --- /dev/null +++ b/ChangeLog.d/context_load_and_session_load_documentation.txt @@ -0,0 +1,6 @@ +Security + * The documentation of mbedtls_ssl_session_save(), + mbedtls_ssl_session_load(), mbedtls_ssl_context_save(), and + mbedtls_ssl_context_load() has been updated to clarify the responsibility + of the application to preserve the confidentiality and integrity of + serialized data, mitigating the risk of misuse of these APIs. From f45d735826a3c2f056d90fd8431ab13bd293dfbb Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Tue, 17 Mar 2026 11:06:04 +0100 Subject: [PATCH 5/6] Improve change log Signed-off-by: Ronald Cron --- ChangeLog.d/context_load_and_session_load_documentation.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog.d/context_load_and_session_load_documentation.txt b/ChangeLog.d/context_load_and_session_load_documentation.txt index f7c1d27f8e..200ab27bf1 100644 --- a/ChangeLog.d/context_load_and_session_load_documentation.txt +++ b/ChangeLog.d/context_load_and_session_load_documentation.txt @@ -4,3 +4,5 @@ Security mbedtls_ssl_context_load() has been updated to clarify the responsibility of the application to preserve the confidentiality and integrity of serialized data, mitigating the risk of misuse of these APIs. + Credit to Haruto Kimura (Stella) for highlighting risks associated with + tampered serialized data. From 86b68120033ab3ddf243bf177a39d6d49657ce8c Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Thu, 26 Mar 2026 13:56:01 +0100 Subject: [PATCH 6/6] Update change log. Signed-off-by: Ronald Cron --- ChangeLog.d/context_load_and_session_load_documentation.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/context_load_and_session_load_documentation.txt b/ChangeLog.d/context_load_and_session_load_documentation.txt index 200ab27bf1..dbbbda1fea 100644 --- a/ChangeLog.d/context_load_and_session_load_documentation.txt +++ b/ChangeLog.d/context_load_and_session_load_documentation.txt @@ -4,5 +4,5 @@ Security mbedtls_ssl_context_load() has been updated to clarify the responsibility of the application to preserve the confidentiality and integrity of serialized data, mitigating the risk of misuse of these APIs. - Credit to Haruto Kimura (Stella) for highlighting risks associated with - tampered serialized data. + Credit to Haruto Kimura (Stella) and Eva Crystal (0xiviel) for + highlighting risks associated with tampered serialized data.