CVE-2026-6458 Overview
CVE-2026-6458 is a cryptographic flaw in Caliptra Core Runtime Firmware, specifically in the aes_256_gcm_update module. The streaming AES-256-GCM API fails to preserve hardware GHASH accumulator state after the first update call when empty Additional Authenticated Data (AAD) is supplied. The resulting authentication tag excludes the first batch of processed ciphertext. An attacker can modify that ciphertext without the tag reflecting the change, breaking the integrity guarantee of AES-GCM. The flaw is tracked under [CWE-325: Missing Cryptographic Step] and affects Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0.
Critical Impact
Authenticated encryption integrity is broken for streaming AES-256-GCM with empty AAD, allowing undetected ciphertext tampering on the first processed batch.
Affected Products
- Caliptra Core Runtime Firmware 2.0.0
- Caliptra Core Runtime Firmware 2.0.1
- Caliptra Core Runtime Firmware 2.1.0
Discovery Timeline
- 2026-06-24 - CVE-2026-6458 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-6458
Vulnerability Analysis
Caliptra is an open-source silicon root of trust developed under the CHIPS Alliance. The Core Runtime Firmware exposes a streaming AES-256-GCM Application Programming Interface (API) backed by a hardware Galois/Counter Mode (GCM) engine. AES-GCM combines counter-mode encryption with the GHASH universal hash to produce an authentication tag covering both AAD and ciphertext.
The aes_256_gcm_update module fails to persist the hardware GHASH accumulator after the first update call when AAD is empty. Subsequent update calls reinitialize or skip the accumulator state, so ciphertext processed during the first call is omitted from the final tag computation. The tag therefore authenticates only a subset of the ciphertext stream.
Root Cause
The root cause is a missing cryptographic step [CWE-325]. The firmware does not save the intermediate GHASH state between streaming update operations on the empty-AAD code path. Because GHASH must be applied iteratively over every ciphertext block, omitting the first batch produces a tag that does not bind that data to the message.
Attack Vector
Exploitation requires adjacent network access and low privileges. An attacker who can intercept or supply ciphertext processed by the affected streaming API can alter the first batch of ciphertext bytes. The recipient validates the GCM tag successfully despite the modification because the tag never covered those bytes. This breaks the integrity and authenticity properties that AES-GCM is expected to provide. Confidentiality of subsequent blocks is not directly affected, but downstream protocol assumptions that rely on authenticated encryption may be subverted.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-834g-h5x6-2hqr for vendor technical details.
Detection Methods for CVE-2026-6458
Indicators of Compromise
- Unexpected acceptance of modified ciphertext blocks by a Caliptra-protected component when streaming AES-256-GCM with empty AAD is in use.
- Discrepancies between expected and observed authentication tags during cross-validation against a software AES-GCM reference implementation.
- Firmware build metadata reporting Core Runtime Firmware versions 2.0.0, 2.0.1, or 2.1.0.
Detection Strategies
- Inventory all devices running Caliptra Core Runtime Firmware and identify components invoking the streaming aes_256_gcm_update path with empty AAD.
- Add integration tests that compare tags produced by the Caliptra hardware path against a known-good AES-GCM software implementation across multi-call streaming inputs.
- Audit higher-level protocols that depend on Caliptra-produced GCM tags for transport or attestation integrity.
Monitoring Recommendations
- Log firmware version reporting from Caliptra-enabled hardware and alert on versions in the vulnerable range.
- Monitor attestation and secure-boot logs for unexpected message validation outcomes that may indicate tag-mismatch handling.
- Track upstream advisories from the CHIPS Alliance Caliptra project for patched firmware releases.
How to Mitigate CVE-2026-6458
Immediate Actions Required
- Identify all deployments using Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0.
- Avoid the streaming AES-256-GCM API with empty AAD until a fixed firmware build is deployed.
- Where feasible, supply at least one byte of AAD to the streaming API to bypass the affected code path.
Patch Information
Refer to the Caliptra GitHub Security Advisory GHSA-834g-h5x6-2hqr for the official fix and updated firmware guidance from the maintainers.
Workarounds
- Use the one-shot (non-streaming) AES-256-GCM API instead of the streaming aes_256_gcm_update path on affected firmware.
- Supply non-empty AAD to streaming AES-256-GCM calls to avoid the vulnerable empty-AAD code path.
- Validate Caliptra-produced GCM tags against a software AES-GCM implementation in security-critical workflows until firmware is updated.
# Configuration example
# Refer to the Caliptra GHSA-834g-h5x6-2hqr advisory for vendor-provided remediation steps.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
