1. Symptoms   Since Q1-25 BSP release, the usage of SPSDK for code signing has been introduced. The devices that support V2X images may face an issue while signing using the signing automation due to the fact the SPSDK release available during Q1-25 release is 2.6.x which does re-signing of V2X containers using OEM keys which are already signed by NXP. Affected Devices: i.MX 95 , i.MX 943, i.MX 8/8X Affected SPSDK version: Any version before SPSDK 3.0.0.   1. Solution   The issue has been fixed in SPSDK 3.0.0 onwards but automation has not been tested with SPSDK 3.0.0 onwards. Please apply/port the 0001-Pull-request-2506-feat-ahab-Skip-signing-of-V2X-cont.patch patch attached here, in versions before SPSDK 3.0.0 and rebuild the SPSDK tool. Now, the secure boot automation can be used to sign the affected devices' images properly.   2. Symptoms   Since Q1-25 BSP release, the usage of SPSDK for code signing has been introduced. Starting from SPSDK 3.0.0 the "signature_provider" has been renamed to "signer" . This will cause secure boot automation to fail.   2. Solution   Please use SPSDK version lower than 3.0.0 to rectify this issue. Eventually this change will be integrated into secure boot automation.   3. Symptoms   The image signing process fails for a boot image that is constructed with AHAB v2 container format. This is due to the fact that the nxp-cst-signer tool release v2.0 requires the container header version to be 0x00.  Affected Devices: i.MX 95 B0, i.MX 943. 3. Solution   The issue can be resolved by ignoring the version number check in nxp-cst-signer release v2.0. The corresponding patch 0001-Ignore-version-number-due-to-updated-contianer-forma.patch is attached to the post. This issue will be fixed and integrated in next release of nxp-cst-signer.    4. Symptoms   The imx-mkimage release lf-6.12.3-1.0.0 and SPSDK release 3.0.0 are known to have an issue with secure boot automation for images that are built with AHAB v2.0 container format due to the fact that neither the imx-mkimage tool correctly set the "Signature Format Header version" of the OEM container nor does the SPSDK modify this version when signing the image. SPSDK fails to sign the image due to this reason and reports invalid signature header version when verbose option (-vv) is enabled.   4. Solution   The patch "0001-add-signature-blk-version.patch" to resolve this issue in imx-mkimage is attached. The patch will be integrated in imx-mkimage Q3 '25 release. ... View more

Overview A software vulnerability - CVE-2023-39902 has been identified in the U-Boot Secondary Program Loader (SPL) prior to version 2023.07 on select i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) Format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target leading to a privilege escalation.  Impacted devices NXP Devices Impacted Silicon Revisions i.MX 8M All i.MX 8M Nano All i.MX 8M Mini All i.MX 8M Plus All   Mitigation This section will cover possible mitigations identified by NXP and recommends users review this vulnerability against their specific use cases.  These mitigations may have varying applicability based on the customer’s designs and should be reviewed based on the established security policy that defines the security goals of the end product. It is up to the user to determine the impact (if any) to their products and take any necessary mitigation actions. U-Boot software patches to address this vulnerability(CVE-2023-39902) were incorporated in the NXP BSP GA Release  LF6.1.36_2.1.0 available for download on nxp.com. All subsequent NXP BSP GA software releases will incorporate the mitigations. To support the default hash and optional FDT signature solutions - four patches for u-boot (one patch only required for Android and one for a document update),  and two patches for imx-mkimage have been developed. Only one mitigation solution needs to be adopted if impacted.     Mitigation Patches Comments U-Boot 0746cfd LFU-573-1 imx8m: hab:Verify hash of FIT FDT structure Default Hash solution 07b6882 LFU-573-2 imx8m: hab:Verify optional FIT FDT signature Optional FIT DT signature solution 0001-MA-21597 check spl fit pointer before parsing it Only Required for Android 25fdc42 LFU-573-3 doc: imx8m: Update iMX8M secure boot and encrypted boot doc Documentation update imx-mkimage 2f2d426 LFU-573-1 imx8m: Generate hash of FIT FDT structure to SPL image Default Hash solution 5a0faef LFU-573-2 imx8m: Reserve new IVT+CSF for FIT FDT signature Optional FIT DT signature solution   Additional Information Customers authenticating additional software images from a bootloader not provided by an NXP BSP, should ensure correct authentication is being performed. For additional information, please contact your NXP Account Manager or Field Representative. You can also enter a technical support ticket and an NXP support engineer will contact you. Acknowledgment NXP would like to thank  Marek Vasut of DENX Software Engineering GmbH for the responsible disclosure. _____________________________________________________________________________ Please note this information is preliminary and subject to change. To the best of NXP's knowledge, the information contained herein is accurate and reliable as of the date of publication; however, NXP does not assume any liability for the accuracy and completeness of the information     ... View more

Overview A vulnerability (CVE-2022-45163) has been identified on select devices when configured in Serial Download Protocol (SDP) mode. In the security-enabled configuration, memory contents could potentially leak via the respective SDP port in cold and warm boot attacks. The recommended mitigation is to completely disable the SDP mode by programming an eFUSE. Impact NXP Device Family Impacted Silicon Revisions i.MX RT101x All i.MX RT102x All i.MX RT105x/6x All i.MX 6 Family All i.MX 7Dual/Solo All i.MX 7ULP All i.MX 8M Quad All i.MX 8M Mini All Vybrid (VFxxx) All   Mitigation  The recommended mitigation is to Disable SDP in production devices by setting the SDP_DISABLE One Time Programmable (OTP)  eFuse to a value of 1’b1.  If available, also set UART Serial Download Disable OTP eFuse bit to 1’b1.   Additional Information For more details, a Security Bulletin is available on the i.MX Security Portal for customers.  NXP has also published an updated Security Checklist including best practices in securing production devices  For access or further information, please contact your NXP Field Support Representative or enter a support request.    Acknowledgment NXP would like to thank the NCC Group for the responsible disclosure of this vulnerability. _________________________________________________________________________ Please note this information is preliminary and subject to change. To the best of NXP's knowledge, the information contained herein is accurate and reliable as of the date of publication; however, NXP does not assume any liability for the accuracy and completeness of the information. ... View more

Deny By Default Enforcing enhanced security in the default state of the SoC out of reset, the Resource Domain Controller(RDCs) are deployed in i.MX 8ULP A1 SoC to implement a deny-by-default (DBD) architecture so that all accesses are denied unless specifically configured to allow access. Once the SoC boots up, the Apps cores can request EdgeLock Secure Enclave to release access of RDCs to respective cores for further configuration.   More information on this feature is attached. ... View more

Overview The High Assurance Boot (HAB), provides an option to extend the root of trust beyond the initial primary boot image. An Application Programming Interface (API) is provided by the on-chip ROM that allows the use of the HAB library to extend the root of trust and authenticate additional software images. A vulnerability has been identified that impacts the use of this HAB library ROM API to extend the root of trust and authenticate additional software images. This vulnerability can be used to bypass signature checks and allow the execution of an un-authenticated software image. To prevent this vulnerability, simple checks in the customer application software are required, prior to calling the HAB library ROM API to authenticate additional software images. Impacted customers using the NXP BSP Reference software can apply two U-Boot software patches to address this vulnerability completely. Impact Only impacts devices configured in a security-enabled mode (SEC_CONFIG[1] eFUSE is programmed) Designs that are not using security-enabled mode are hence not impacted. All HAB versions up to 4.3.6 are impacted, only when using the HAB library ROM API to extend the root of trust and authenticate additional software images (e.g. Kernel) Customer applications that are not using this optional feature of the HAB library ROM API to authenticate additional software images are hence not impacted. This vulnerability does not impact the primary boot image Applications extending the root of trust that expose methods (local or remote) to update the product software image may be impacted Designs that prevent physical access to the device and do not utilize Over the Air (OTA) updates are not impacted. Software Mitigation Two U-Boot software patches to address this vulnerability were incorporated in the L4.9.88_2.0.0-ga software release. All subsequent NXP BSP GA software releases incorporate these checks in the U-Boot bootloader by default. Hence the mitigations are already incorporated in the latest NXP BSP releases and no further action is required. MLK-16703: HAB: Check if CSF is valid before authenticating image MLK-14945: HAB: Check if IVT valid before authenticating image Customers using U-Boot releases between L4.1.15_1.0.0-ga and L4.9.11_1.0.0-ga can refer to the following Yocto Patch releases. imx_v2017.03_4.9.11_1.0.0_ga imx_v2016.03_4.1.15_2.0.0_ga imx_v2015.04_4.1.15_1.0.0_ga For customers using older U-Boot Software releases patches are available on request. Code signing Tool Customers are recommended to use the latest version of the i.MX High Assurance Boot Reference Code Signing Tool - (CST) that has removed unsupported commands. Additional Information Refer to the Application Note - AN12263 - HABv4 RVT Guidelines & Recommendations and the HAB API Document (Included in the CST package) For more details, a Security Bulletin is available on the i.MX Security Portal for customers. For access or further information, please contact your NXP Field Support Representative or enter a support request.  _________________________________________________________________________ Please note this information is preliminary and subject to change. To the best of NXP's knowledge, the information contained herein is accurate and reliable as of the date of publication; however, NXP does not assume any liability for the accuracy and completeness of the information. ... View more