Core Rom
Monthly
Secure boot bypass in Caliptra Core ROM 2.1.0-2.1.1 (subsystem mode) enables a local attacker controlling compromised MCU firmware to silently load unauthorized firmware into ICCM while attestation continues reporting the originally verified image digest, masking the compromise entirely. The TOCTOU race in UpdateResetFlow::run() is compounded by absent validation of the caller-supplied AXI staging address against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, creating a window between verification and ICCM load during which SRAM contents can be swapped. No public exploit has been identified and no CISA KEV listing applies, but the severity lies in the attack's undetectability through standard attestation channels.
Debug unlock token cross-device reuse in Caliptra Core ROM and Core Firmware (subsystem mode) allows an attacker who already holds access to an integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a token originally issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce prevents replay of previously captured tokens but does not bind a token to a specific target device identity, enabling lateral debug access within a shared-key-hash trust group. No public exploit has been identified and the CVSS 4.0 score of 1.8 reflects the narrow real-world impact, which is bounded by the requirement for high-privilege signing-service access and the hard constraint that exploitation cannot cross key-hash group boundaries.
Secure boot bypass in Caliptra Core ROM 2.1.0-2.1.1 (subsystem mode) enables a local attacker controlling compromised MCU firmware to silently load unauthorized firmware into ICCM while attestation continues reporting the originally verified image digest, masking the compromise entirely. The TOCTOU race in UpdateResetFlow::run() is compounded by absent validation of the caller-supplied AXI staging address against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, creating a window between verification and ICCM load during which SRAM contents can be swapped. No public exploit has been identified and no CISA KEV listing applies, but the severity lies in the attack's undetectability through standard attestation channels.
Debug unlock token cross-device reuse in Caliptra Core ROM and Core Firmware (subsystem mode) allows an attacker who already holds access to an integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a token originally issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce prevents replay of previously captured tokens but does not bind a token to a specific target device identity, enabling lateral debug access within a shared-key-hash trust group. No public exploit has been identified and the CVSS 4.0 score of 1.8 reflects the narrow real-world impact, which is bounded by the requirement for high-privilege signing-service access and the hard constraint that exploitation cannot cross key-hash group boundaries.