VulnerabilityDeferred

CVE-2025-54515

This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.

LOW 1.0EPSS 0.12%

Does this matter?

Lower severity and a low EPSS score (0.12%). Track it; it rarely justifies an emergency change on its own.

Description

The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.

CVSS 4.0: 1.0 LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.12% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-1284
Source: psirt@amd.com

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8020.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.