TI PSIRT ID
TI-PSIRT-2023-080189
Definitions
- Gadget: A sequence of
instructions existing in memory maliciously used by an attacker in a way
unintended by the original program. Gadgets are often chained together to work
as a simple unit to perform arbitrary computations or functions that serve the
attacker's purposes.
- ROP:
Return-oriented-programming; a method of attack that chains gadgets together by
modifying the return address location of the stack memory.
- PSIRT: TI’s Product
Security Incident Response Team oversees the process of accepting and responding
to reports of potential security vulnerabilities involving TI semiconductor
products, including hardware, software and documentation. For more information,
see TI PSIRT.
- CVSS: Common Vulnerability
Scoring System, maintained by FIRST.
Affected Products
- TMS320F28003x
- TMS320F2838x
- TMS320F280013x
- TMS320F280015x
- TMS320F28P65x
Potentially Impacted
Features
The following attributes may be
affected by this vulnerability:
- Confidentiality and integrity of
EXEONLY code in memory.
- Confidentiality and integrity of
non-EXEONLY data/code in memory.
Suggested Mitigations
Enable two features existing on the
device:
- JTAGLOCK. The JTAG
interface should be locked. See the SPRACS4 application report
for how to lock the JTAG interface.
- Zero-pin boot to flash boot
method. The boot method should be programmed to always boot directly to
an internal flash boot mode, either “Flash” or “Secure Flash”. See the device’s
Technical Reference Manual for details on how to enable.
These two features provide protection
from an attacker connecting a debugger or using a bootloader to load code into
internal memory. This injected code is required to launch an ROP/gadget attack on
secure memory regions. Best cybersecurity coding and testing practices should also
be employed on user application code to prevent attackers from loading their code
into internal memory. This includes, but is not limited to, secondary bootloaders,
firmware update code, and communication stacks.
Acknowledgments
We would like to thank Zhao Hai from
Cyberpeace Tech Co., Ltd. for reporting this vulnerability to the TI Product
Security Incident Response Team (PSIRT).