Executive brief
Caliptra Core Runtime Firmware, which provides secure silicon root-of-trust functions, contains a flaw in its cryptographic processing module. When certain encryption tasks are performed without additional authenticated data, the system fails to properly verify the integrity of the first block of data. This allows an attacker with local network access to modify parts of the encrypted information without the system detecting the tampering, potentially compromising the security of the protected device.
Technical details
A vulnerability exists in the Caliptra Core Runtime Firmware within the `aes_256_gcm_update()` function of the `drivers/src/aes.rs` module. When the streaming AES-256-GCM API is invoked with empty Authenticated Additional Data (AAD), the hardware GHASH accumulator state is not saved after the initial update call. This causes the final authentication tag to exclude the first batch of processed ciphertext. An attacker with 'Low' privileges and 'Adjacent' network access can exploit this to modify the first batch of ciphertext without triggering an authentication failure. The issue is fixed in versions 2.0.2 and 2.1.1.
Affected products
- Caliptra Core Runtime Firmware 2.0.0, 2.0.1, 2.1.0
Timeline
- 2026-06-23: disclosed: GHSA-834g-h5x6-2hqr published
- 2026-06-24: advisory: NVD published CVE-2026-6458