Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016502 advisory.

    Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input     parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The     parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks     in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged     attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0     through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context     of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is     possible. An attacker can still crash TF-A, however.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input
    parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The
    parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks
    in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged
    attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0
    through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context
    of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is
    possible. An attacker can still crash TF-A, however. (CVE-2023-49100)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input     parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The     parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks     in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged     attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0     through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context     of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is     possible. An attacker can still crash TF-A, however. (CVE-2023-49100)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313097	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: arm-trusted-firmware (UTSA-2026-016502)	Nessus	Unity Linux Local Security Checks	medium
427742	Alpine: multiple arm-trusted-firmware packages: security update to 2.8.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
427742	Alpine: multiple arm-trusted-firmware packages: security update to 2.8.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
226885	Linux Distros Unpatched Vulnerability : CVE-2023-49100	Nessus	Misc.	medium

Detections

Analytics

CVE-2023-49100

medium

Tenable Plugins

medium

medium

medium

medium