Trusted Firmware
Monthly
A stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard Processor Systems) through socfpga_v2.14.0 lets a high-privileged local attacker corrupt a fixed-size stack buffer inside the secure monitor and cross the normal-world-to-secure-world trust boundary. The attacker must already control the normal-world OS on the affected HPS device (CVSS vector PR:H, AV:L, UI:N), so this is an access-gated escalation primitive rather than a remotely reachable issue; the assessed impact is high integrity and availability loss with limited confidentiality exposure in the secure world (CVSS 8.3). No public exploit code has been identified at time of analysis, and no evidence of active exploitation was provided by the vendor or in the supplied intelligence.
Local, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard Processor System (HPS) devices can exploit an untrusted pointer dereference (CWE-822) in Trusted Firmware builds through socfpga_v2.14.0, achieving high integrity and availability impact within the secure world while confidentiality impact is limited. Exploitation requires prior privileged code execution in the normal world to pass a crafted pointer via SMC calls; there is no remote or network-facing exposure and no user interaction. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware dereference an attacker-supplied pointer, corrupting firmware memory protections and crossing the normal/secure-world boundary in all releases up to and including socfpga_v2.14.0. Rated CVSS 8.3 (v4.0) with high integrity and availability impact, the flaw is real but narrow in scope: exploitation requires an already-high-privileged, locally-positioned attacker (PR:H, AV:L, no user interaction), so realistic exposure is limited to actors who have already compromised the running system or its supply chain. No public exploit code has been identified at time of analysis, and neither CISA KEV listing, EPSS score, nor a confirmed patched version was provided in the available data.
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga_v2.14.0) lets a local attacker who already controls the non-secure rich OS - root or kernel on the HPS ARM cores - corrupt the secure monitor's stack via the SMC interface and potentially escalate across the trust boundary into the secure world. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) confirms this is an access-gated privilege/trust-boundary escalation requiring an existing high-privileged foothold, not a remotely reachable default-configuration flaw; impact to integrity and availability is high and scope is changed, but confidentiality impact is limited. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard Processor Systems) through socfpga_v2.14.0 lets a high-privileged local attacker corrupt a fixed-size stack buffer inside the secure monitor and cross the normal-world-to-secure-world trust boundary. The attacker must already control the normal-world OS on the affected HPS device (CVSS vector PR:H, AV:L, UI:N), so this is an access-gated escalation primitive rather than a remotely reachable issue; the assessed impact is high integrity and availability loss with limited confidentiality exposure in the secure world (CVSS 8.3). No public exploit code has been identified at time of analysis, and no evidence of active exploitation was provided by the vendor or in the supplied intelligence.
Local, high-privileged attackers who can invoke the ARM Trusted Firmware secure-monitor interface on Altera SoCFPGA Hard Processor System (HPS) devices can exploit an untrusted pointer dereference (CWE-822) in Trusted Firmware builds through socfpga_v2.14.0, achieving high integrity and availability impact within the secure world while confidentiality impact is limited. Exploitation requires prior privileged code execution in the normal world to pass a crafted pointer via SMC calls; there is no remote or network-facing exposure and no user interaction. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Privileged local code running in the non-secure world of an Altera SoC FPGA HPS device can make Altera Trusted Firmware dereference an attacker-supplied pointer, corrupting firmware memory protections and crossing the normal/secure-world boundary in all releases up to and including socfpga_v2.14.0. Rated CVSS 8.3 (v4.0) with high integrity and availability impact, the flaw is real but narrow in scope: exploitation requires an already-high-privileged, locally-positioned attacker (PR:H, AV:L, no user interaction), so realistic exposure is limited to actors who have already compromised the running system or its supply chain. No public exploit code has been identified at time of analysis, and neither CISA KEV listing, EPSS score, nor a confirmed patched version was provided in the available data.
Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.
Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.
Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.
A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga_v2.14.0) lets a local attacker who already controls the non-secure rich OS - root or kernel on the HPS ARM cores - corrupt the secure monitor's stack via the SMC interface and potentially escalate across the trust boundary into the secure world. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) confirms this is an access-gated privilege/trust-boundary escalation requiring an existing high-privileged foothold, not a remotely reachable default-configuration flaw; impact to integrity and availability is high and scope is changed, but confidentiality impact is limited. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).