Bug 1227540 (CVE-2024-6564) - VUL-0: CVE-2024-6564: arm-trusted-firmware: Buffer overflow in "rcar_dev_init" due to using untrusted data as a loop counter
Summary: VUL-0: CVE-2024-6564: arm-trusted-firmware: Buffer overflow in "rcar_dev_init...
Status: NEW
Alias: CVE-2024-6564
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/413031/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-6564:7.8:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-09 07:57 UTC by SMASH SMASH
Modified: 2024-07-19 07:21 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-07-09 07:57:29 UTC 
Buffer overflow in "rcar_dev_init"  due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6564
https://www.cve.org/CVERecord?id=CVE-2024-6564
https://asrg.io/security-advisories/cve-2024-6564/
https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2
Comment 2 Ivan Ivanov 2024-07-19 07:21:09 UTC 
The only TF-A package wich we distribute is using upstream repository [1],[2].
Further we officially distribute TF-A package for RPi4 [3] only, because of
device constraints.

Firmware, TF-A in this case, is supposed to be distributed by 
platform/device vendors.

So I whould say that we are not affected.

[1] https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
[2] https://build.opensuse.org/package/show/hardware:boot/arm-trusted-firmware
[3] arm-trusted-firmware:rpi4