Hello,

 

This email is to notify you of 3 new security vulnerabilities affecting Trusted Firmware-M (TF-M).

 

  1. Pre-auth OOB write in RSE SFCP handshake hijacks BL1 boot-ROM control flow

Some RSE configurations place nodes in a trusted subnet whose links are initially untrusted, so the SFCP implementation performs a handshake before normal traffic is protected with the negotiated session key.

Advisory: https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/rse_sfcp_pre_auth_oob_write.html

Fix: https://review.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m/+/c5f4cb39eff725e71f9bc4222d6199209fc1da57

 

  1. Plaintext SFCP packet on RSE returns delegated-attestation private key

The platform expects that the RSEs in the system are members of the trusted subnet and therefore use encrypted communications. This is not enforced on the “non-interrupt driven” receive code path for sfcp_receive_msg. Therefore, external RSEs in the system could send unencrypted packets which would be successfully received.

Advisory: https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/rse_sfcp_plaintext_packets.html

Fix: https://review.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m/+/5f592a5fbeb13a2c00ccf3070ce57bb97db213f7

 

  1. OOB flash write in Corstone-1000 update bricks the secure enclave

The Corstone-1000 FWU bootloader backend writes update payload blocks directly to flash through ProgramData().

The write address is calculated from the target image partition base plus the number of image bytes already received. Without validating this calculated range against the flash address space and the selected update partition size, a sequence of FWU writes can extend past the end of the intended partition.

Advisory: https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/cs1k_oob_flash_write_secure_enclave.html

Fix: https://review.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m/+/060ec25948f29f66b026be3c4858c2dbdfe0c443

 

If you have any questions or comments, please let us know.

 

Best regards,

Anton

on behalf of the TF-M Security Team