CyberRota Analysis
AI-GeneratedA time-of-check time-of-use (TOCTOU) vulnerability in the Caliptra Core ROM allows a local attacker with compromised MCU firmware to bypass secure boot protections by exploiting unvalidated AXI staging addresses, enabling unauthorized firmware modifications. This flaw can lead to the loading of malicious firmware while the attestation process falsely reports the integrity of the original image. Organizations using affected versions (2.1.0 through 2.1.1) should prioritize remediation to protect against potential firmware compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1.