Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Mbed-TLS/TF-PSA-Crypto
development @ ec56e6a
290
Fixes
0
CVEs
CRITICAL
Peak severity
51.5%
Coverage
Highlights
Buffer Overflow: 85 prior fixes. Scrutinize any change in this area.
library/ssl_tls.c: most-fixed (47 issues). Treat as high-risk during review.
231 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Buffer Overflow: Multiple critical and high-severity overflows in TLS 1.2/1.3 key share parsing due to missing length checks before memcpy into fixed buffers.
Auth Bypass: Numerous fixes address authorization bypasses in early data acceptance and PSK/ciphersuite validation, indicating a complex, error-prone area where checks are often missing or misplaced.
Buffer Overflow: A large cluster of fixes adds LOCAL_INPUT_ALLOC/LOCAL_OUTPUT_ALLOC buffer protection and bounds checks across many PSA operations (import, export, cipher, key agreement, sign/verify), showing a systemic lack of input/output buffer size validation.