Advisory TFMV-15
Title |
Out-of-bounds read in crypto AEAD service |
|---|---|
CVE ID |
|
Public Disclosure Date |
Nov 10, 2026 |
Versions Affected |
TF-M v2.3.0 |
Configurations |
All platforms using AEAD encryption through the SW implementation provided by TF-PSA-Crypto |
Impact |
A non-secure client sets the AEAD nonce length past the 16-byte buffer and the Crypto partition reads out-of-bound bytes disclosing secure-partition memory. |
Fix Version |
|
Credits |
animo |
Background
The TF-M Crypto service provides authenticated encryption with associated data (AEAD) operations to Non-secure clients through the PSA Crypto API.
A vulnerability exists in the single part AEAD encryption/decryption API function where the caller-provided nonce_length is not validated against the fixed 16-byte nonce buffer. The unchecked length is forwarded to the underlying PSA Crypto implementation, potentially causing an out-of-bounds read when processing the nonce.
Impact
A malicious Non-secure client can exploit this vulnerability by supplying a nonce length larger than the allocated buffer.
When using AES-GCM, through the software based implementation provided by TF-PSA-Crypto, this may result in the disclosure of adjacent Secure memory through the generated authentication tag, compromising confidentiality. A sufficiently large nonce length may also trigger a Secure fault, causing the system to reset or halt and resulting in a denial of service.
The vulnerability affects TF-M configurations using AEAD operations based on the AES-GCM algorithm and redirecting them to the SW based crypto implementation provided by TF-PSA-Crypto.
Mitigation
The TF-M Crypto service must validate the caller-provided nonce_length against TFM_CRYPTO_MAX_NONCE_LENGTH before invoking the underlying PSA Crypto AEAD operations.
SPDX-License-Identifier: BSD-3-Clause
SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors