CVE-2026-11835 in Core ROM
Summary
by MITRE • 08/04/2026
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra.
This issue affects Core ROM: 2.1.0 through 2.1.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability under discussion represents a critical security flaw in the Caliptra Core ROM firmware that combines elements of time-of-check time-of-use (TOCTOU) race conditions with inadequate input validation mechanisms. This weakness exists within the UpdateResetFlow::run() function operating in subsystem mode, creating a window where malicious actors can manipulate the firmware update process. The flaw stems from insufficient validation of AXI staging addresses against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR parameter, allowing attackers to specify memory locations that should remain protected. This vulnerability falls under CWE-367 which specifically addresses Time-of-Check to Time-of-Use race conditions, and it also relates to CWE-20 for improper input validation.
The technical implementation of this vulnerability enables a compromised local attacker to silently bypass the secure boot mechanism by exploiting a specific sequence in the firmware update flow. When Caliptra processes firmware updates, it performs verification checks at one point in time but then loads the firmware from a different memory location during a subsequent phase. The missing validation allows attackers to supply an AXI staging address that points to memory outside of the designated secure staging area. This creates an opportunity where firmware can be modified between the verification phase and the actual loading into the Instruction Cache Control Memory (ICCM) region. The attacker's malicious code can be loaded during this window while the system continues to believe it is executing the originally verified image, creating a sophisticated stealth mechanism that evades detection.
The operational impact of this vulnerability extends beyond simple privilege escalation as it fundamentally undermines the integrity and authenticity guarantees provided by the secure boot process. The compromised system continues to report attestation data that matches the originally verified image digest, masking the actual compromise from both automated monitoring systems and human operators. This creates a false sense of security while simultaneously allowing persistent malicious code execution within the trusted execution environment. The vulnerability requires a pre-existing compromise of the MCU firmware with access to the AXI manager and unprotected SRAM regions reachable by Caliptra, making it particularly dangerous in environments where physical or logical access has already been compromised. This attack vector aligns with ATT&CK technique T1547.009 which covers Boot or Logon Autostart Execution and T1068 which covers Exploitation for Privilege Escalation.
The security implications of this vulnerability are severe as it effectively neutralizes the secure boot chain that is fundamental to protecting embedded systems from malicious firmware modifications. Attackers can leverage this weakness to install backdoors, modify cryptographic keys, or establish persistent access points within the system while maintaining the appearance of legitimate operation. The fact that this vulnerability affects Caliptra Core ROM versions 2.1.0 through 2.1.1 indicates it represents a widespread issue affecting multiple releases in the product line, suggesting either insufficient regression testing or a fundamental flaw in the design approach. The combination of insufficient address validation with the TOCTOU timing window creates an attack surface that is particularly difficult to detect and remediate, as the compromise occurs silently without triggering standard integrity checks.
Mitigation strategies should focus on implementing strict input validation for all AXI staging addresses against the configured strap parameters before any firmware loading operations occur. The system must eliminate the time-of-check to time-of-use window by ensuring that verification and loading operations occur in a single atomic operation or by maintaining consistent memory mappings throughout the process. Additionally, enhanced attestation mechanisms should be implemented to detect inconsistencies between expected and actual memory contents during the update process. Hardware-level protections such as memory protection units and address space isolation should be strengthened to prevent unauthorized access to staging areas. The fix should also include proper logging of all firmware update operations with detailed verification results to enable easier detection of potential compromises. Organizations should conduct comprehensive security assessments of their Caliptra implementations to identify affected systems and implement appropriate mitigations, including firmware updates when available and operational procedures to monitor for signs of compromise in environments where such vulnerabilities might be exploited.