The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly. When two execution contexts contend on the lock, k_mutex_lock() pends the blocking thread on the wait queue via z_pend_curr(), which calls sys_dlist_append() on the zeroed list and dereferences a NULL tail pointer (tail->next = node), faulting the kernel. The lock is held during TLS handshake credential loading and by all credential add/get/delete operations, so a deployment performing concurrent TLS handshakes (for example a server handling multiple simultaneous connections from a remote peer) or a credential-management operation concurrent with a handshake can trigger the dereference. The impact is a denial of service: a deterministic kernel panic / device reset on the first contention. There is no memory corruption beyond the NULL dereference and no confidentiality or integrity impact; mutual exclusion on the fast path remains correct. Exposure is limited to builds with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE enabled (PSA Protected Storage / TF-M platforms); the default volatile RAM backend initializes its lock correctly and is unaffected. The fix initializes the mutex statically with K_MUTEX_DEFINE(credential_lock), providing a valid wait queue so the contended path no longer touches a NULL list.
| Métrique | Valeur | Interprétation |
|---|---|---|
|
AV (Vecteur d'Attaque)
Attack Vector
|
Network (N)
|
Exploit possible à distance via réseau (HTTP, API, etc.) |
|
AC (Complexité d'Attaque)
Attack Complexity
|
High (H)
|
Conditions spécifiques doivent être réunies pour exploiter |
|
PR (Privilèges Requis)
Privileges Required
|
None (N)
|
Aucune authentification requise |
|
UI (Interaction Utilisateur)
User Interaction
|
None (N)
|
Aucune interaction utilisateur nécessaire |
|
S (Périmètre)
Scope
|
Unchanged (U)
|
Impact reste dans le périmètre du composant compromis |
|
C (Impact Confidentialité)
Confidentiality Impact
|
None (N)
|
Aucune divulgation d'informations |
|
I (Impact Intégrité)
Integrity Impact
|
None (N)
|
Aucune modification de données possible |
|
A (Impact Disponibilité)
Availability Impact
|
High (H)
|
Interruption totale du service possible |
Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention