Arm Trusted Firmware-A before v2.10, SDEI service (sdei_interrupt_bind SMC handler): An SMC argument from the normal

CVSS 4.4CVE-2023-49100Firmware, BMC & network fabricTFV-11SDEI interrupt bind out-of-bounds readcurated

Impact

An SMC argument from the normal world reaches plat_ic_get_interrupt_type without adequate validation, giving an out-of-bounds read inside EL3. It is a small primitive on its own, but EL3 is the most privileged code on the part - it owns the secure world, the PSCI power state machine and the root of trust - so any memory-safety defect there is a stepping stone toward full platform compromise from a host kernel that is otherwise contained.

Who can reach it

Host kernel or hypervisor code (EL1/EL2) issuing SDEI SMCs. A guest cannot reach it directly unless the hypervisor forwards SDEI, so the realistic path is a tenant who has already got kernel on the host, or a compromised host agent.

What to do

Upgrade to TF-A v2.10 or later with the TFV-11 fix, via an OEM platform firmware build. Flash + reboot + drain. If SDEI is not used by your platform, having it compiled out of BL31 is the cleaner answer - ask the OEM whether it is even enabled before assuming you are exposed.

References

https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-11.html https://nvd.nist.gov/vuln/detail/CVE-2023-49100

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.