CVE-2021-40327

Vulnerability

Trusted Firmware-M (TF-M) version 1.4.0, when configured with the Profile Small security profile, contains an incorrect access control vulnerability in the Crypto service. The Non-Secure Processing Environment (NSPE) can access a secure key held by the Crypto service based solely on knowledge of its key ID, without any authorization check verifying the relationship between the caller and the key owner.

Exploitation

An attacker operating from the NSPE can exploit this vulnerability by simply knowing the key ID of a secure key. No authentication or additional privileges are required beyond the ability to make requests to the Crypto service. The attacker can then retrieve the secure key by issuing a request with the known key ID.

Impact

Successful exploitation allows an attacker in the NSPE to obtain a secure key that should only be accessible to authorized secure components. This leads to disclosure of cryptographic material, potentially compromising the confidentiality and integrity of data protected by that key.

Mitigation

As of the publication date, no fix has been disclosed in the available references. Users of TF-M 1.4.0 with Profile Small should monitor the Arm security updates page [1] for future patches or consider upgrading to a later version if available.