PT-2023-15442 · Unknown+1 · Arm Trusted Firmware+1

Demi Marie Obenour · Published 2023-01-16 · Updated 2026-06-05 · CVE-2022-47630

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Trusted Firmware-A versions 2.8 and earlier

Description The issue is related to an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects the downstream use of get ext and auth nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.

Recommendations For versions 2.8 and earlier, consider disabling the X.509 parser for parsing boot certificates until a patch is available. Restrict access to the get ext and auth nvctr functions to minimize the risk of exploitation. Avoid using these functions in sensitive operations until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-47630

OESA-2023-1899

OPENSUSE-SU-2024:12883-1

Affected Products

Debian

Arm Trusted Firmware

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2022-47630 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47630 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47630 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47630 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47630 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/01/16/8 · Patch
• https://trustedfirmware.org/news · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-47630 · Vendor Advisory
• https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-47630 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1899 · Vendor Advisory
• https://t.me/cvenotify/102657 · Telegram Post
• https://t.me/cvenotify/118382 · Telegram Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1899 · Note
• https://t.me/cvenotify/42114 · Telegram Post