CVE-2025-53022

{
  "id": "CVE-2025-53022",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53022",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-30T19:50:00.471157Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-30T20:15:36.760",
  "references": [
    {
      "url": "https://git.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m.git/+/refs/heads/main/secure_fw/partitions/firmware_update/bootloader/mcuboot/tfm_mcuboot_fwu.c#257",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/fwu_tlv_payload_out_of_bounds_vulnerability.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.trustedfirmware.org/projects/tf-m/",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process."
    },
    {
      "lang": "es",
      "value": "TrustedFirmware-M (también conocido como Trusted Firmware for M profile Arm CPUs) en versiones anteriores a la 2.1.3 y 2.2.x anteriores a la 2.2.1 carece de validación de longitud durante una actualización de firmware. Al procesar una nueva imagen, el módulo Firmware Upgrade (FWU) no valida el campo de longitud de la estructura Type-Length-Value (TLV) de los componentes dependientes con respecto al tamaño máximo permitido. Si la longitud especificada en el TLV supera el tamaño del búfer asignado en la pila, el módulo FWU sobrescribirá el búfer (y posiblemente otros datos de la pila) con el contenido del valor del TLV. Un atacante podría aprovechar esto manipulando una entrada TLV maliciosa en la sección sin protección de la imagen de actualización de MCUBoot. Al configurar el campo de longitud para que supere el tamaño esperado de la estructura, el atacante puede manipular la memoria de la pila del sistema durante el proceso de actualización."
    }
  ],
  "lastModified": "2026-06-17T09:37:29.523",
  "sourceIdentifier": "cve@mitre.org"
}