Threats affecting pkg:github/Core ROM

CVE-2026-11835 is a medium-severity TOCTOU race condition vulnerability in Caliptra Core ROM versions 2.1.0 through 2.1.1. It allows a compromised local attacker with high privileges to bypass secure boot by exploiting missing input validation in the UpdateResetFlow::run() function. The attacker can supply an unvalidated AXI staging address to modify firmware after verification but before loading, while attestation reports the original verified image digest, masking the compromise.

CVE-2026-11836 is a low-severity vulnerability in Caliptra Core ROM and Core Firmware that involves insufficient verification of data authenticity in the validate_debug_unlock_token() function. An attacker with access to the integrator's debug unlock signing service can unlock production debug on unintended devices within a set sharing the same debug unlock key hash. The vulnerability does not allow unlocking devices outside this set due to a 384-bit challenge nonce that prevents replay attacks. Affected versions include Core ROM 2.0.0 through 2.0.2 and 2.1.0 through 2.1.1, and Core Firmware 2.0.0 through 2.0.1 and 2.1.0. No patch or official remediation is currently documented.