Log in Start free

Vulnerability · Published Jun 24, 2024 · Assigned by ASRG

CVE-2024-6287Incorrect Address Range Calculations

High 7.5

In plain English

A high-severity security flaw in rcar_gen3_v2.5 from Renesas. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 91.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12arm-trusted-firmwareno fix listedDEBIAN-CVE-2024-6287
Debian:13arm-trusted-firmwareno fix listedDEBIAN-CVE-2024-6287
Debian:14arm-trusted-firmwareno fix listedDEBIAN-CVE-2024-6287
Ubuntu:25.10arm-trusted-firmwareno fix listedUBUNTU-CVE-2024-6287
Ubuntu:26.04:LTSarm-trusted-firmwareno fix listedUBUNTU-CVE-2024-6287
Ubuntu:26.10arm-trusted-firmwareno fix listedUBUNTU-CVE-2024-6287

Affected products (as reported)

VendorProductVersions
Renesas rcar_gen3_v2.5 6a96c18c474e6339fab93f54d52aa7dcc4b70e52 – before 954d488a9798f8fda675c6b57c571b469b298f04

Weakness: CWE-682 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References