PSIRT Advisory – ASA-0006

CVE ID: CVE-2026-58004

Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware (TF-A)

Vulnerability Details:In socfpga_vab_authentication(), a size_t image length is stored in a 32-bit integer, truncating lengths above 4 GiB. The resulting payload length is then used as both the destination and source size in memcpy_s, so its bounds check cannot detect the copy. A crafted oversized image can therefore cause approximately 1 GiB to be copied into a 1,023-byte buffer on the HPS EL3 stack, potentially corrupting EL3 control flow and enabling code execution within the EL3 privilege domain. EL3 compromise is serious but does not constitute complete platform control: the Secure Device Manager (SDM) operates in a separate, higher-privilege domain and stores the most sensitive platform secrets; compromising HPS EL3 does not by itself grant SDM access. Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-121: Stack-based Buffer Overflow

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-58005

Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3 on Trusted Firmware (TF-A)

Vulnerability Details:The SiP v2 mailbox dispatcher accepts an address supplied by a non-secure EL1 caller and casts it directly to a pointer without validating that it lies in permitted DDR. The SEND_COMMAND and POLL_RESPONSE paths can therefore cause EL3 to read from or write to attacker-selected physical addresses, bypassing intended non-secure/secure memory isolation and potentially corrupting EL3 state or other TrustZone-protected memory. Exploitation requires privileged non-secure execution capable of issuing the relevant SMCs. The impact is confined to the EL3 and secure-world resources reachable through these paths: the Secure Device Manager (SDM) operates in a separate, higher-privilege domain and stores the most important platform secrets, so compromisingHPSEL3 does not by itself provide SDM access or complete platform control.Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-119: Improper Restriction of Operations within Bounds of Memory Buffer

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-58006

Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption on Trusted Firmware (TF-A)

Vulnerability Details:An insufficiently validated output-pointer handling flaw in the Altera SoCFPGA BL31 mailbox service allows a normal-world caller to direct V2 mailbox responses or V3 asynchronous callback data to attacker-chosen destinations. On affected paths, BL31 does not enforce equivalent non-secure/DDR range checks, and the V3 response-copy logic can exceed the caller-declared callback length. The resulting primitive can corrupt memory mapped to EL3 and should be described as normal-world-to-EL3 secure-memory corruption. It does not, by itself, demonstrate compromise of the Secure Device Manager (SDM): the SDM operates in a separate privilege domain above EL3 and holds the most sensitive platform secrets. Therefore,HPSEL3 compromise or corruption must not be characterized as complete platform control or SDM access.Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-822: Untrusted Pointer Dereference

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-58007

Unchecked SDM mailbox response address enables EL3 secure-memory corruption on Trusted Firmware (TF-A)

Vulnerability Details:The Trusted Firmware-A SMC handler for ALTERA_SIP_SMC_ASYNC_GEN_MBOX_CMD accepts command and response buffer addresses from CPU registers and forwards them without verifying that they reside in Non-Secure DDR. When the Secure Device Manager (SDM) returns a mailbox response, EL3 code writes response data through the attacker-supplied response address, allowing a privileged attacker controlling the non-secure OS to corrupt mapped EL3 secure memory. Consequences may include TF-A state or code corruption, denial of service, or potentially altered EL3 execution, depending on the target and mitigations. EL3 is not the highest trust level: SDM operates in a separate, higher-privilege domain and stores the most sensitive platform secrets. CompromisingHPSEL3 does not directly grant SDM access or complete platform control.Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-822: Untrusted Pointer Dereference

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-58008

Unchecked HKDF key-size input in EL3 causes a stack buffer overflow, enabling non-secure-world denial of service or potential EL3 code execution onTrusted Firmware (TF-A)

Vulnerability Details:The intel_fcs_hkdf_request() function in Altera’s Trusted Firmware platform layer copies an attacker-controlled op_key_size value from SMC register x7 into a fixed-size EL3 stack buffer without validating the requested length against the HKDF key-object limit or remaining buffer capacity. A non-secure-world attacker able to invoke the HKDF SMC can therefore cause memory corruption, with impact ranging from EL3 crash to potential control-flow hijacking, depending on platform mitigations and runtime conditions. EL3 is not the highest trust domain: the Secure Device Manager (SDM) operates in a separate, higher-privilege domain and retains the most sensitive platform secrets. Compromise ofHPSEL3 does not, by itself, grant access to SDM secrets or SDM control.Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-121: Stack-based Buffer Overflow

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-13465

EL3 Stack Buffer Overflow in FCS HKDF Request on Trusted Firmware (TF-A)

Vulnerability Details:intel_fcs_hkdf_request() accepts attacker-controlled op_key_size from SMC register x7 without bounds checking, potentially causing anHPSEL3 Stack Buffer Overflow.Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-121: Stack-based Buffer Overflow

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-13466

SHA384 Unit Confusion in VAB Authentication on Trusted Firmware (TF-A)

Vulnerability Details:A unit mismatch in socfpga_vab.c causes the SHA384 digest buffer to allocate only 12 bytes instead of the required 48 bytes. The authentication routine subsequently writes 48 bytes, resulting in a 36-byte stack buffer overflow that may corrupt adjacent variables, including image and certificate pointers. Additionally, the verification logic compares only 12 bytes of the digest, weakening authentication from SHA384 to a truncated 96-bit comparison.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-131: Incorrect Calculation of Buffer Size

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

CVE ID: CVE-2026-13467

Systemic Missing Address Validation in 11+ SiP SMC Handlers on Trusted Firmware (TF-A)

Vulnerability Details:SiP SMC handlers pass non-secure-world-supplied memory addresses directly to mailbox/DMA operations without calling is_address_in_ddr_range() inside theHPSEL3.Exploitation requires privileged HPS EL1/OS execution.

Affected Platforms:Stratix® 10 SoC HPS, Agilex® 7 SoC HPS, Agilex® 5 SoC HPS, Agilex® 3 SoC HPS, and N5X® SoC HPS

Mitigations and Recommendations:Altera recommends updating the arm-trusted-firmware to socfpga_v2.14.1 or newer located at https://github.com/altera-fpga/arm-trusted-firmware

Description/CWE: CWE-787: Out-of-bounds Write

CVSS 3.1 Base Score: 8.2 High

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

CVSS 4.0 Base Score: 8.3 High

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L

Acknowledgements:
Altera would like to acknowledge the following for reporting these issues to Altera: Hasanka Amarasinghe for CVE-2026-58004 and CVE-2026-58005. Haruki Oyama for CVE-2026-58008, CVE-2026-13465, CVE-2026-13466 & CVE-2026-13467.

Altera provides these materials as-is, with no express or implied warranties. All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Altera products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request. Altera products that have met their End of Servicing Updates may no longer receive functional and security updates.

Altera technologies’ features and benefits depend on system configuration and may require enabled hardware, software, or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at https://www.altera.com.

Some results may have been estimated or simulated using internal Altera analysis or architecture simulation or modeling and are provided for informational purposes only. Any differences in your system hardware, software, or configuration may affect your actual performance.

© Altera Corporation. Altera, the Altera logo, and other Altera marks are trademarks of Altera Corporation in the United States and other countries. Other names and brands may be claimed as the property of others.