Executive brief
OpenAMP is a software framework used in embedded systems to manage communication between different processors, such as those found in automotive and industrial equipment. A vulnerability in its firmware loading component allows a specially crafted firmware image to bypass security checks and corrupt the system's memory. This could allow an attacker to gain control over the main processor, potentially leading to a complete system takeover or permanent device failure.
Technical details
An integer overflow vulnerability exists in the OpenAMP ELF loader (elf_loader.c) when parsing PT_LOAD segments of firmware images. The vulnerability occurs because the loader performs 32-bit multiplication on two 16-bit values extracted directly from the ELF header without sufficient overflow validation. On 32-bit embedded architectures like STM32MP1, Zynq, and i.MX, this overflow causes the calculated destination region size to wrap around to a small value, effectively bypassing subsequent length checks. An attacker providing a crafted firmware image can trigger this overflow to perform an out-of-bounds write (via memcpy) into host memory, potentially achieving arbitrary code execution on the host processor.
Affected products
- OpenAMP Project OpenAMP 2025.10.0
Timeline
- 2026-04-30: disclosed: Vulnerability reported by Innora Security Research.
- 2026-05-01: advisory: CVE-2026-37540 published.