Security Advisories

ID

Title

TFMV-1

NS world may cause the CPU to perform an unexpected return operation due to unsealed stacks.

TFMV-2

Invoking Secure functions from handler mode may cause TF-M IPC model to behave unexpectedly.

TFMV-3

abort() function may not take effect in TF-M Crypto multi-part MAC/hashing/cipher operations.

TFMV-4

NSPE may access secure keys stored in TF-M Crypto service in Profile Small with Crypto key ID encoding disabled.

TFMV-5

psa_fwu_write() may cause buffer overflow in SPE.

TFMV-6

Partial tag comparison when using Chacha20-Poly1305 on the PSA driver API interface in CryptoCell enabled platforms

TFMV-7

ARoT can access PRoT data via debug logging functionality

TFMV-8

Unchecked user-supplied pointer via mailbox messages may cause write of arbitrary address

TFMV-9

FWU does not check the length of the TLV’s payload

TFMV-10

Missing NS pointer validation in platform mailbox init

TFMV-11

Incorrect FMP Header Fragment Reconstruction Allows Attacker-Controlled Firmware Version Values

TFMV-12

Pre-auth OOB write in RSE SFCP handshake hijacks BL1 boot-ROM control flow

TFMV-13

Plaintext SFCP packet on RSE returns delegated-attestation private key

TFMV-14

OOB flash write in corstone1000 update bricks the secure enclave

SPDX-License-Identifier: BSD-3-Clause

SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors