CVE-2023-40271

Summary

CVE-2023-40271 is a vulnerability affecting Trusted Firmware-M versions 1.6.0, 1.6.1, 1.7.0, and 1.8.0, which use the CryptoCell accelerator on platforms with the CryptoCell PSA Driver software Interface and the Chacha20-Poly1305 algorithm for Authenticated Encryption with Associated Data. The single-part verification function, implemented with a dedicated function during the build-time configuration phase, only compares the first 4 bytes of the authentication tag instead of the full 16 bytes, putting unauthenticated payloads at risk of being identified as authentic. This issue does not affect multipart functions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.