CVE-2021-45450: 
Mbed TLS vulnerability analysis and mitigation

CVE-2021-45450 affects Mbed TLS versions before 2.28.0 and 3.x before 3.1.0. The vulnerability involves the functions psaciphergenerateiv and psacipher_encrypt, which allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application (NVD, Debian Tracker).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue specifically relates to the cryptographic implementation in the PSA (Platform Security Architecture) cipher functions, where the output buffer's location could be exploited (NVD).

The vulnerability could allow an attacker to bypass security policies or perform oracle-based decryption of data when the output buffer is accessible to untrusted applications. This primarily affects the confidentiality of the system, as indicated by the CVSS score showing high impact on confidentiality but no impact on integrity or availability (NVD).

The vulnerability has been fixed in Mbed TLS versions 2.28.0 and 3.1.0. Users are advised to upgrade to these or later versions. For Fedora users, updates are available for both Fedora 36 and 37 with version 2.28.1-1. Gentoo users should upgrade to version 2.28.1 or later (Fedora Update, Gentoo Advisory).