Actively exploited · Published May 25, 2021 · Assigned by mitre

CVE-2021-27562

Medium 5.5 Exploited

In plain English

A medium-severity out-of-bounds write in Trusted Firmware from Arm. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)3.1%top 12.3% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://developer.arm.com/support/arm-security-updates x_refsource_MISC
https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/svc_caller_sp_fetching_vulnerability.rst x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27562 government-resource