CVE-2024-7883
Published: Oct 31, 2024
Modified: Oct 31, 2024
CVSS v3.1
3.7
Description
When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.
| Vendor | Product | Versions |
|---|---|---|
Arm Ltd | Arm Compiler for Embedded | affected 6.6 - <= 6.22 |
Arm Ltd | Arm Compiler for Embedded FuSa 6.16LTS | affected All versions |
Arm Ltd | Arm Compiler for Embedded FuSa 6.21 | affected All versions |
Arm Ltd | Arm Compiler for Functional Safety 6.6 | affected All versions |
Arm Ltd | CLang | affected 13 - <= 19 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now