CVE-2021-45451 Security feature bypass in n/a
Attackers can bypass cryptographic policies or decrypt data via oracle attacks in Mbed TLS when nonce generation buffers are accessible to untrusted applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45451?
CVE-2021-45451 is a high-severity vulnerability in Arm Mbed Tls, published on 21 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
Weakness: CWE-327
Which versions are affected by CVE-2021-45451?
It affects 2 products.
Products include Arm Mbed Tls, Fedoraproject Fedora.
How do I fix CVE-2021-45451?
Upgrade to a fixed version.
Is CVE-2021-45451 being exploited?
There is no known exploitation of CVE-2021-45451 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as GHSA-2grh-pj67-4p6p, JLSEC-2025-216.