Vulnerability · Published Apr 24, 2024 · Assigned by Arm

CVE-2024-0151

Medium 6.5

In plain English

A medium-severity security flaw in Arm v8-M Security Extensions Requirements on Development Tools from Arm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.

Affected products (as reported)

Vendor	Product	Versions
Arm	Arm v8-M Security Extensions Requirements on Development Tools	1.0 – before 1.4

Weakness: CWE-241 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions