What’s Vulnerable › Vulnerabilities

CVE-2022-47630

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-16 · updated 2026-06-17
• Weakness: CWE-125

Description

Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.

Affected products

• TrustedFirmware Trusted Firmware-A: from 1.2 through 2.8

References

• http://www.openwall.com/lists/oss-security/2023/01/16/8
• https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html
• https://www.trustedfirmware.org/news/
• http://www.openwall.com/lists/oss-security/2023/01/16/8
• https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html
• https://www.trustedfirmware.org/news/

Get alerted when CVE-2022-47630 or the next vulnerability affects your stack