Description
Improper handling of non-secure-world input in NSC veneer
functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),
affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a
non-secure caller to supply unvalidated pointers or untrusted data, causing a
timing side-channel, TOCTOU condition, or format-string misuse, potentially
resulting in secure-world memory disclosure or denial of service. All software
versions starting from 26.06.01-lts and 26.09.00 have fixed this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NXP | MCUXpresso SDK | < 26.09.00, < 26.06.01-lts | 26.09.00 |