Trustedfirmware Trusted Firmware-M vulnerabilities

CVE-2021-27562 [MEDIUM] CWE-787 CVE-2021-27562: In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secur In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.

CVE-2023-40271 [HIGH] CWE-697 CVE-2023-40271: In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, w In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function (defined during the build-time configuration phase) imple

CVE-2021-43619 [HIGH] CWE-120 CVE-2021-43619: Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.

CVE-2021-32032 [HIGH] CWE-401 CVE-2021-32032: In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abort() operation in the associated cryptographic library from freeing internal resources, causing a memory leak.

CVE-2021-40327 [MEDIUM] CWE-862 CVE-2021-40327: Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.

CVE-2023-51712 [MEDIUM] CVE-2023-51712: An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in th An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.