CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
eclipse
ThreadX
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material. (NVD)
What to Do
Monitor eclipse's web page for any future patch releases.