Description (CNA)
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Caliptra / Core ROM | affected 2.0.0 through 2.0.2; unaffected 2.0.3; affected 2.1.0 through 2.1.1; unaffected 2.1.2 |
| Caliptra / Core Firmware | affected 2.0.0 through 2.0.1; unaffected 2.0.2; affected 2.1.0; unaffected 2.1.1 |
CWE
CWE-345
References
ADP enrichment
No English description supplied.
No references supplied.