Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.4
CVE-2023-49100: arm-trusted-firmware can crash when Linux sends bad request
CVE-2023-49100 · published 2 years ago
Summary
The early boot software called ARM Trusted Firmware (TF‑A) versions before 2.10 do not check a value coming from the Linux kernel correctly. A malicious or compromised Linux system can send a specially crafted request that makes TF‑A read memory outside its bounds, causing it to stop working. Updating TF‑A to version 2.10 or later fixes the check and prevents the crash.
What to do
- Update debian arm-trusted-firmware to version 2.10.0+dfsg-1.
- Update arm-trusted-firmware to version 2.8.14-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | arm-trusted-firmware | All versions |
| Debian:13 | debian | arm-trusted-firmware |
< 2.10.0+dfsg-1 Fix: upgrade to 2.10.0+dfsg-1
|
| Debian:14 | debian | arm-trusted-firmware |
< 2.10.0+dfsg-1 Fix: upgrade to 2.10.0+dfsg-1
|
| Alpine:v3.18 | – | arm-trusted-firmware |
< 2.8.14-r0 Fix: upgrade to 2.8.14-r0
|
Original advisory text
Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_b...
Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.
References
- https://security-tracker.debian.org/tracker/CVE-2023-49100 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2023-49100 Vendor Advisory
- https://github.com/ARM-software/arm-trusted-firmware/blob/a05414bedc9b1cc35cf079... URL
- https://github.com/ARM-software/arm-trusted-firmware/blob/a05414bedc9b1cc35cf079... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49100... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-49100 Vendor Advisory
- https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.4
Medium
Type
CWE-125Out-of-bounds Read
Timeline
Published21 Feb 2024
Updated4 Nov 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-49100 · OSV
ALPINE-CVE-2023-49100 · OSV
CVE-2023-49100 · NVD
CVE-2023-49100 · OSV
Track software like this
Free during beta