Advisory TFMV-12
Title |
Pre-auth OOB write in RSE SFCP handshake hijacks BL1 boot-ROM control flow |
|---|---|
CVE ID |
|
Public Disclosure Date |
Sept 14, 2026 |
Versions Affected |
TF-M v2.3.0 |
Configurations |
Only RSE platforms |
Impact |
An on-die SFCP peer node obtains a 32-byte attacker-controlled out-of-bounds write in the bl1_1 boot ROM during the pre-authentication boot-time session-key handshake |
Fix Version |
|
Credits |
Mohammad Seet / Rayan Al Garni |
Background
Some RSE configurations place nodes in a trusted subnet whose links are initially untrusted, so the SFCP implementation performs a handshake before normal traffic is protected with the negotiated session key.
The RSE SFCP encryption-handshake responder uses the remote node id taken directly from a received packet header as an array index, with no bounds check. During encrypted packet processing by the responder, the remote node ID is used directly as an index into the trusted-subnet node array. A crafted pre-authentication handshake packet could therefore select an out-of- range node ID and cause SFCP to read or update sequence-tracking state outside the trusted-subnet node array.
Impact
An attacker able to inject SFCP traffic before the trusted-subnet handshake is complete can trigger an out-of-bounds write in RSE firmware. On affected RSE systems this can corrupt adjacent state used during early boot. With a suitably chosen packet sequence, this may allow control-flow corruption in the BL1 boot- ROM execution context, up to attacker control of BL1 boot-ROM control flow.
Mitigation
Validate SFCP packet node IDs before any packet-type-specific processing, and
reject sender or receiver IDs greater than or equal to SFCP_NUMBER_NODES.
SPDX-License-Identifier: BSD-3-Clause
SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors