CVE-2021-32032

Vulnerability

In Trusted Firmware-M through version 1.3.0, a flaw exists in the memory cleanup logic for multi-part cryptographic operations. When such an operation fails, the allocated memory is not properly released because the abort() function in the associated cryptographic library fails to free internal resources, leading to a memory leak [1].

Exploitation

An attacker would need to trigger a failure in a multi-part cryptographic operation within the Trusted Firmware-M environment. This could potentially be achieved by introducing a fault or by sending malformed data that causes the cryptographic process to abort without proper cleanup. No further exploitation details are disclosed in the available references [1].

Impact

Successful exploitation results in a memory leak, which over time could exhaust available memory resources, leading to denial of service. The vulnerability does not appear to provide direct information disclosure, privilege escalation, or code execution based on the available description [1].

Mitigation

The issue is present in Trusted Firmware-M through version 1.3.0. The vendor (Trusted Firmware) has not yet disclosed a specific fix or patched version in the provided references [1]. Users should monitor the Trusted Firmware project for updates and apply a patch when available. There is no mention of this CVE being listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.