MbedTLS LMS Signature Forgery Vulnerability via Fault Injection

A vulnerability in MbedTLS versions 3.3.0 prior to 3.6.4 allows for Leighton-Micali Signature (LMS) forgery under certain fault conditions. The issue arises in the `mbedtls_lms_verify` function, where unchecked return values from internal Merkle tree functions can lead to the acceptance of invalid signatures. An attacker capable of inducing a hardware hash accelerator fault could exploit this flaw by reusing uninitialized stack data, bypassing signature verification. This vulnerability is particularly concerning when hardware-accelerated SHA-256 hashing is used, as the fault injection could be exploited to manipulate the verification process.

Impact

Exploitation of this vulnerability could lead to unauthorized acceptance of forged LMS signatures, undermining the integrity of the signature verification process.