Log in Start free

Vulnerability · Published Oct 31, 2024 · Assigned by Arm

CVE-2024-7883CMSE secure state may leak from stack to floating-point registers

Low 3.7

In plain English

A low-severity security flaw in Arm Compiler for Embedded from Arm Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12llvm-toolchain-14no fix listedDEBIAN-CVE-2024-7883
Debian:12llvm-toolchain-15no fix listedDEBIAN-CVE-2024-7883
Debian:12llvm-toolchain-16no fix listedDEBIAN-CVE-2024-7883
Debian:13llvm-toolchain-17no fix listedDEBIAN-CVE-2024-7883
Debian:13llvm-toolchain-18no fix listedDEBIAN-CVE-2024-7883
Debian:12llvm-toolchain-19no fix listedDEBIAN-CVE-2024-7883
Debian:13llvm-toolchain-19no fix listedDEBIAN-CVE-2024-7883
Ubuntu:22.04:LTSllvm-toolchain-11no fix listedUBUNTU-CVE-2024-7883
Ubuntu:22.04:LTSllvm-toolchain-12no fix listedUBUNTU-CVE-2024-7883
Ubuntu:22.04:LTSllvm-toolchain-13no fix listedUBUNTU-CVE-2024-7883
Ubuntu:22.04:LTSllvm-toolchain-14no fix listedUBUNTU-CVE-2024-7883
Ubuntu:24.04:LTSllvm-toolchain-14no fix listedUBUNTU-CVE-2024-7883
Ubuntu:25.10llvm-toolchain-14no fix listedUBUNTU-CVE-2024-7883
Ubuntu:22.04:LTSllvm-toolchain-15no fix listedUBUNTU-CVE-2024-7883
Ubuntu:24.04:LTSllvm-toolchain-15no fix listedUBUNTU-CVE-2024-7883
Ubuntu:24.04:LTSllvm-toolchain-16no fix listedUBUNTU-CVE-2024-7883
Ubuntu:24.04:LTSllvm-toolchain-17no fix listedUBUNTU-CVE-2024-7883
Ubuntu:25.10llvm-toolchain-17no fix listedUBUNTU-CVE-2024-7883
Ubuntu:26.04:LTSllvm-toolchain-17no fix listedUBUNTU-CVE-2024-7883
Ubuntu:26.10llvm-toolchain-17no fix listedUBUNTU-CVE-2024-7883
Ubuntu:24.04:LTSllvm-toolchain-18no fix listedUBUNTU-CVE-2024-7883
Ubuntu:25.10llvm-toolchain-18no fix listedUBUNTU-CVE-2024-7883
Ubuntu:24.04:LTSllvm-toolchain-19no fix listedUBUNTU-CVE-2024-7883
Ubuntu:25.10llvm-toolchain-19no fix listedUBUNTU-CVE-2024-7883

Affected products (as reported)

VendorProductVersions
Arm Ltd Arm Compiler for Embedded 6.6 – through 6.22
Arm Ltd Arm Compiler for Embedded FuSa 6.16LTS All versions
Arm Ltd Arm Compiler for Embedded FuSa 6.21 All versions
Arm Ltd Arm Compiler for Functional Safety 6.6 All versions
Arm Ltd CLang 13 – through 19

Weakness: CWE-226 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References