DescriptionTrusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
arm-trusted-firmware (PTS)bullseye2.4+dfsg-2vulnerable
sid, trixie2.10.0+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

Debian ships an almost unpatched copy, so is not affected by itself
Still tracking for the purpose of potential downstream providers (v2.9-rc0) (v2.9-rc0) (v2.9-rc0) (v2.9-rc0)

Search for package or bug name: Reporting problems