Description
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Caliptra Core ROM
Default version status: unaffected
2.0.0 to ≤ 2.0.2affected2.0.3unaffected2.1.0 to ≤ 2.1.1affected2.1.2unaffected
Caliptra Core Firmware
Default version status: unaffected
2.0.0 to ≤ 2.0.1affected2.0.2unaffected2.1.0affected2.1.1unaffected