PT-2023-15442 · Unknown+1 · Arm Trusted Firmware+1

Demi Marie Obenour · Publicado 2023-01-16 · Atualizado 2026-06-05 · CVE-2022-47630

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Trusted Firmware-A versions 2.8 and earlier

Description The issue is related to an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects the downstream use of get ext and auth nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.

Recommendations For versions 2.8 and earlier, consider disabling the X.509 parser for parsing boot certificates until a patch is available. Restrict access to the get ext and auth nvctr functions to minimize the risk of exploitation. Avoid using these functions in sensitive operations until the issue is resolved.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2022-47630

OESA-2023-1899

OPENSUSE-SU-2024:12883-1

Produtos afetados

Debian

Arm Trusted Firmware

Referências · 18

• https://nvd.nist.gov/vuln/detail/CVE-2022-47630 · Nota de Segurança
• https://t.me/cvenotify/102657 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-47630 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47630 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-47630 · Aviso do Fabricante
• https://t.me/cvenotify/118382 · Publicação no Telegram
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1899 · Nota
• https://t.me/cvenotify/42114 · Publicação no Telegram
• https://t.me/cvenotify/42094 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47630 · Aviso do Fabricante
• https://t.me/cibsecurity/56558 · Publicação no Telegram
• https://t.me/cveNotify/166278 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/01/16/8 · Correção
• https://trustedfirmware.org/news · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-47630 · Aviso do Fabricante