CVE-2023-49100

What it actually does

Out-of-bounds read in the SDEI service of TF-A (EL3) due to insufficient validation of the x1 register parameter passed to plat_ic_get_interrupt_type in sdei_interrupt_bind, enabling a root-privileged Normal World attacker to issue arbitrary SMC calls that control x0-x6 and crash TF-A without data leakage.

Why it matters to the business

Potential denial-of-service on ARM-based systems using affected TF-A versions, leading to firmware crashes and system unavailability; low immediate risk given absence from KEV and stable low EPSS but still requires patching to maintain platform integrity.

How an attack unfolds

An attacker first compromises the Linux kernel to obtain root privileges in the Normal World, then crafts and issues arbitrary SMC calls that bypass checks in plat_ic_is_sgi, passing invalid x1 values into sdei_interrupt_bind to trigger out-of-bounds reads in TF-A and induce a crash.

How to fix it

Upgrade arm-software/arm-trusted-firmware to commit b6c0948400594e3cc4dbb5a4ef04b815d2675808 or later (version 2.10+); validate the fix by confirming the commit is present in the build and re-test SDEI interrupt binding paths.

How to confirm the fix worked

Inspect TF-A build logs or binary for the presence of commit b6c0948400594e3cc4dbb5a4ef04b815d2675808; attempt to reproduce the original crash with crafted SMC inputs after upgrade to confirm the out-of-bounds condition is eliminated.

Typical attack path

1. Gain root access in the Normal World Linux kernel
2. Issue arbitrary SMC calls controlling registers x0 through x6
3. Invoke sdei_interrupt_bind with an unvalidated x1 parameter that passes plat_ic_is_sgi checks
4. Trigger plat_ic_get_interrupt_type on an out-of-bounds address in EL3 context
5. Cause TF-A crash without returning data to non-secure memory

How to detect it

Review EL3 firmware crash logs and SDEI service entries for repeated invalid interrupt bind attempts or unexpected exceptions originating from plat_ic_get_interrupt_type; correlate with root-level processes issuing SMC calls.

What your security team should do

• Prioritize firmware upgrade to the fixed commit across all affected ARM platforms
• Monitor system logs for unexpected TF-A EL3 crashes or SDEI-related exceptions
• Restrict SMC call issuance from the Normal World where possible through platform configuration
• Include TF-A version checks in secure boot and attestation processes