PT-2024-13674 · Unknown+1 · Arm Trusted Firmware+1

0Ddc0De

+2

·

Published

2024-02-21

·

Updated

2024-10-31

·

CVE-2023-49100

CVSS v3.1

4.4

Medium

VectorAV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Trusted Firmware-A (TF-A) versions prior to 2.10
Description The issue is related to a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei interrupt bind(). This parameter is then passed to a call to plat ic get interrupt type(), and it can be any arbitrary value that passes checks in the function plat ic is sgi(). A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls, allowing control over the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3), but because the read value is never returned to non-secure memory or in registers, no leak is possible. However, an attacker can still crash TF-A.
Recommendations For versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the SDEI service to minimize the risk of exploitation. Additionally, limiting the ability of a compromised Normal World to issue arbitrary SMC calls can help mitigate the risk.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-49100
OESA-2024-1264

Affected Products

Debian
Arm Trusted Firmware