Security Vulnerability Notice - Partial tag comparison when using Chacha20-Poly1305 on the PSA driver API interface in CryptoCell enabled platforms
Hi Everyone,
There is a new security vulnerability discovered on the PSA Driver API for CryptoCell enabled platforms, described as "Partial tag comparison when using Chacha20-Poly1305 on the PSA driver API interface in CryptoCell enabled platforms".
Please find the security advisory specific to TF-M and patches that have been developed as per the TrustedFirmware.org security process [1] below :
* TF-M Security advisory: TFMV-6: Add cc3xx_partial_tag_compare_on_chacha20_poly1305 advisory (I44bc426f) · Gerrit Code Review (trustedfirmware.org)https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/22995
* Patch to fix the issue has been already merged on master branch as commit https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/commit/?id=2e821...
* TF-Mv1.8.1 will be released in the next days containing the same hotfix
Please let us know if you have any comments.
Best regards, /Antonio
[1] https://developer.trustedfirmware.org/w/collaboration/security_center/report...https://developer.trustedfirmware.org/w/collaboration/security_center/reporting/
Hi Everyone,
There is a new security vulnerability found in SPM logging service which allows a malicious ARoT partition to expose any memory data via stdout interface, usually UART. Please check the details in:
* TF-M Security advisory attached to this mail: * Patch to fix the issue on the main branch as commit: https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/27793 This vulnerability fix will be included in the upcoming TF-M v2.1.0 release without a dedicated hot fix. Thanks to Roman Mazurak who reported the issue. Please let us know if you have any comments.
Best regards, Anton
tf-m@lists.trustedfirmware.org
-
Anton Komlev -
Antonio De Angelis