Caliptra
Monthly
Firmware verification bypass in Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0 allows an attacker with high privileges to load unverified MCU firmware during a hitless update. The flaw resides in the ActivateFirmwareCmd::activate_fw module, where an incorrect check of a function return value causes the Root-of-Trust to skip authentication of the Microcontroller Unit firmware image. No public exploit identified at time of analysis, and the issue was responsibly disclosed by the Caliptra project itself.
Secure boot bypass in Caliptra Core ROM 2.1.0-2.1.1 (subsystem mode) enables a local attacker controlling compromised MCU firmware to silently load unauthorized firmware into ICCM while attestation continues reporting the originally verified image digest, masking the compromise entirely. The TOCTOU race in UpdateResetFlow::run() is compounded by absent validation of the caller-supplied AXI staging address against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, creating a window between verification and ICCM load during which SRAM contents can be swapped. No public exploit has been identified and no CISA KEV listing applies, but the severity lies in the attack's undetectability through standard attestation channels.
Debug unlock token cross-device reuse in Caliptra Core ROM and Core Firmware (subsystem mode) allows an attacker who already holds access to an integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a token originally issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce prevents replay of previously captured tokens but does not bind a token to a specific target device identity, enabling lateral debug access within a shared-key-hash trust group. No public exploit has been identified and the CVSS 4.0 score of 1.8 reflects the narrow real-world impact, which is bounded by the requirement for high-privilege signing-service access and the hard constraint that exploitation cannot cross key-hash group boundaries.
Missing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD - to abuse by a privileged local attacker operating in subsystem mode. By supplying mailbox commands containing unverified AXI bus addresses, an attacker can crash the Caliptra Root of Trust firmware, causing a denial of service against the hardware security enclave. The vendor notes that security impact beyond availability is integration-specific, meaning depending on how the SoC integrates Caliptra, subsequent-system integrity (SI:L per CVSS 4.0) may also be affected. No public exploit is identified at time of analysis.
Broken GCM integrity in Caliptra Core Runtime Firmware 2.0.0-2.1.0 allows an adjacent, low-privileged attacker to silently tamper with ciphertext produced by the streaming AES-256-GCM API when called with empty AAD. The root defect - a missing save of the hardware GHASH accumulator state after the first streaming update call - causes the final authentication tag to exclude the first batch of processed ciphertext, nullifying the integrity guarantee of authenticated encryption for that block. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Firmware verification bypass in Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0 allows an attacker with high privileges to load unverified MCU firmware during a hitless update. The flaw resides in the ActivateFirmwareCmd::activate_fw module, where an incorrect check of a function return value causes the Root-of-Trust to skip authentication of the Microcontroller Unit firmware image. No public exploit identified at time of analysis, and the issue was responsibly disclosed by the Caliptra project itself.
Secure boot bypass in Caliptra Core ROM 2.1.0-2.1.1 (subsystem mode) enables a local attacker controlling compromised MCU firmware to silently load unauthorized firmware into ICCM while attestation continues reporting the originally verified image digest, masking the compromise entirely. The TOCTOU race in UpdateResetFlow::run() is compounded by absent validation of the caller-supplied AXI staging address against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, creating a window between verification and ICCM load during which SRAM contents can be swapped. No public exploit has been identified and no CISA KEV listing applies, but the severity lies in the attack's undetectability through standard attestation channels.
Debug unlock token cross-device reuse in Caliptra Core ROM and Core Firmware (subsystem mode) allows an attacker who already holds access to an integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a token originally issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce prevents replay of previously captured tokens but does not bind a token to a specific target device identity, enabling lateral debug access within a shared-key-hash trust group. No public exploit has been identified and the CVSS 4.0 score of 1.8 reflects the narrow real-world impact, which is bounded by the requirement for high-privilege signing-service access and the hard constraint that exploitation cannot cross key-hash group boundaries.
Missing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD - to abuse by a privileged local attacker operating in subsystem mode. By supplying mailbox commands containing unverified AXI bus addresses, an attacker can crash the Caliptra Root of Trust firmware, causing a denial of service against the hardware security enclave. The vendor notes that security impact beyond availability is integration-specific, meaning depending on how the SoC integrates Caliptra, subsequent-system integrity (SI:L per CVSS 4.0) may also be affected. No public exploit is identified at time of analysis.
Broken GCM integrity in Caliptra Core Runtime Firmware 2.0.0-2.1.0 allows an adjacent, low-privileged attacker to silently tamper with ciphertext produced by the streaming AES-256-GCM API when called with empty AAD. The root defect - a missing save of the hardware GHASH accumulator state after the first streaming update call - causes the final authentication tag to exclude the first batch of processed ciphertext, nullifying the integrity guarantee of authenticated encryption for that block. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.