Log in Start free

Vulnerability · Published Feb 21, 2024 · Assigned by mitre

CVE-2023-49100

Medium 4.4

In plain English

A medium-severity out-of-bounds read in the arm-trusted-firmware package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 86.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20arm-trusted-firmware2.8.14-r0ALPINE-CVE-2023-49100
Debian:12arm-trusted-firmwareno fix listedDEBIAN-CVE-2023-49100
Debian:13arm-trusted-firmware2.10.0+dfsg-1DEBIAN-CVE-2023-49100
Debian:14arm-trusted-firmware2.10.0+dfsg-1DEBIAN-CVE-2023-49100
Ubuntu:22.04:LTSarm-trusted-firmwareno fix listedUBUNTU-CVE-2023-49100

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References