CVE-2022-47630 | Vulnetix

CVE-2022-47630 PUBLISHED CVSS 7.4 HIGH

Reported by mitre · Published January 16, 2023

Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
trusted_firmware-a	trustedfirmware	2.8
trusted_firmware-a	arm	2.8

Risk scores

CVSS 3.1

7.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Vendor	Product	Versions
n/a	n/a	n/a
n/a	n/a	*

Timeline

Jan 16, 2023 CVE Published
Jan 17, 2023 EPSS Score (30 in total, the first dated here)
Apr 8, 2025 CVE Updated
Apr 3, 2026 Security Advisory
May 24, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2022-47630
vulnetix vdb fixes CVE-2022-47630

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-47630/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

[oss-security] 20230116 CVE-2022-47630 Trusted Firmware-A - Out-of-bounds read in X.509 parser mailing-list

Look up in the Resolve Platform →