Arm Trusted Firmware-A through v2.8, X.509 certificate parser used by Trusted Board Boot (get_ext, auth_nvctr)

CVE-2022-47630Firmware, BMC & network fabricTFV-10TF-A X.509 parser out-of-bounds readcurated

Impact

The code that validates the secure boot certificate chain reads out of bounds on a malformed certificate. So the component whose entire job is to decide whether firmware is trustworthy can be driven off the rails by the untrusted input it is inspecting - dangerous read side effects and leakage of microarchitectural state. It undermines the chain of trust at the exact point where a bare-metal operator is trying to prove to the next tenant that the box is clean.

Who can reach it

An attacker able to place a crafted certificate in the boot chain: control of the firmware image or the firmware-update path. On bare-metal GPU rental, a prior tenant with flash write access. Not remote.

What to do

Upgrade TF-A past v2.8 with the TFV-10 fix and have the OEM re-issue the platform firmware. Flash + reboot + drain per node. There is no runtime mitigation - the parser runs before anything you control. Pair it with the operational control that actually helps: measure and attest boot firmware between tenants instead of trusting the parser.

References

https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html https://nvd.nist.gov/vuln/detail/CVE-2022-47630

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.