CVE-2023-40271: trustedfirmware trusted_firmware-m Incorrect Comparison

Vulnerability summary

CVE-2023-40271 is a high (CVSS 7.5) Incorrect Comparison vulnerability in trustedfirmware trusted_firmware-m. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-09-2023
   PublishedVulnerability first disclosed.
2. 26-09-2024
   Last modifiedVulnerability information updated.

Description

In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function (defined during the build-time configuration phase) implemented with a dedicated function (i.e., not relying on usage of multipart functions), the buffer comparison during the verification of the authentication tag does not happen on the full 16 bytes but just on the first 4 bytes, thus leading to the possibility that unauthenticated payloads might be identified as authentic. This affects TF-Mv1.6.0, TF-Mv1.6.1, TF-Mv1.7.0, and TF-Mv1.8.

• CWE-697Incorrect ComparisonThe product compares two entities in a security-relevant context, but the comparison is incorrect.