CVE-2021-40327
published 2022-01-13CVE-2021-40327: Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based…
PriorityP432medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
1.19%
64.2th percentile
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| trustedfirmware | trusted_firmware-m | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
osv5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ARM Trusted Firmware-M 1.4.0 NSPE access control
vuldb·2026-06-06·CVSS 5.9
CVE-2021-40327 [MEDIUM] ARM Trusted Firmware-M 1.4.0 NSPE access control
A vulnerability was found in ARM Trusted Firmware-M 1.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component NSPE. The manipulation results in improper access controls.
This vulnerability was named CVE-2021-40327. The attack needs to be approached within the local network. There is no available exploit.
GHSA
GHSA-p88f-g9m7-hv9c: Trusted Firmware-M (TF-M) 1
ghsa_unreviewed·2022-01-14
CVE-2021-40327 [MEDIUM] CWE-862 GHSA-p88f-g9m7-hv9c: Trusted Firmware-M (TF-M) 1
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.
OSV
CVE-2021-40327: Trusted Firmware-M (TF-M) 1
osv·2022-01-13·CVSS 5.9
CVE-2021-40327 [MEDIUM] CVE-2021-40327: Trusted Firmware-M (TF-M) 1
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.
No detection rules found.
No public exploits indexed.
https://developer.arm.com/support/arm-security-updateshttps://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/profile_small_key_id_encoding_vulnerability.htmlhttps://developer.arm.com/support/arm-security-updateshttps://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/profile_small_key_id_encoding_vulnerability.html
2022-01-13
Published