CVE-2025-54515 Details
Description
The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.
A vulnerability exists in the Arm Trusted Firmware for Cortex-A processors on AMD Versal Adaptive SoCs. The issue arises because the Secure Flag for Power State Coordination Interface (PSCI) commands was incorrectly set to secure, rather than reflecting the actual security state of the processor. This misconfiguration could allow PSCI requests to be falsely perceived as originating from secure state processors, instead of non-secure ones.
AMD plans to address this vulnerability in the 2025.2 software release by ensuring that the Arm Cortex-A processor's security state is correctly communicated to the Arm Trusted Firmware, allowing for proper filtering of PSCI requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 23, 2025CISA-ADP
Assessed Nov 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8020.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AMD Versal Adaptive SoC | All versions |
CPE
Remediation
| |
| AMD Arm Trusted Firmware | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 19, 2025 | CVE Modified | [email protected] |
| Nov 23, 2025 | New CVE Received | [email protected] |