Crypto-server isolation bypass via mutable shared buffers

Improper shared-memory handling in Mbed TLS 2.18.0 through 2.28.7 and 3.0.0 through 3.5.2 allows attackers to bypass crypto-server isolation. The PSA Crypto implementation repeatedly reads input and intermediate buffers and writes intermediate results to attacker-mutable shared memory without first copying or isolating them. Only deployments that separate an untrusted client from a crypto server through shared memory are affected; Mbed Crypto is also affected, and RSA operations can overread buffers or use private keys outside policy.