TOCTOU and Missing Input Validation in Caliptra Core ROM

Executive Summary

This is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in Caliptra Core ROM's UpdateResetFlow::run() function. It allows a local attacker with compromised MCU firmware to bypass secure boot by providing an unvalidated AXI staging address. The attacker can modify firmware between verification and loading into ICCM without detection, as attestation still reports the original verified image digest.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking Caliptra Core ROM versions between 2.1.0 and 2.1.1. Inspect firmware logs for AXI staging address modifications or unexpected SRAM access patterns. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to silently replace verified firmware with malicious code on affected systems. This could lead to unauthorized code execution, data breaches, or complete system compromise while maintaining the appearance of a secure boot process.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Caliptra Core ROM to a version outside the affected range (2.1.0-2.1.1). Ensure MCU firmware is not compromised and lacks AXI manager access to unprotected SRAM. Validate all firmware images before secure boot.

Useful 0 Not Useful 0