3.7

CVE-2024-7883

Exploit

CMSE secure state may leak from stack to floating-point registers

When using Arm Cortex-M Security Extensions (CMSE), Secure stack 
contents can be leaked to Non-secure state via floating-point registers 
when a Secure to Non-secure function call is made that returns a 
floating-point value and when this is the first use of floating-point 
since entering Secure state. This allows an attacker to read a limited 
quantity of Secure stack contents with an impact on confidentiality. 
This issue is specific to code generated using LLVM-based compilers.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Arm ≫ Arm Compiler For Embedded Version >= 6.6 < 6.23
Arm ≫ Arm Compiler For Embedded Fusa Version6.16 SwEditionlts
Arm ≫ Arm Compiler For Embedded Fusa Version6.21 SwEditionlts
Arm ≫ Clang Version >= 11.0.0 < 20.1.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.584
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
arm-security@arm.com 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-226 Sensitive Information in Resource Not Removed Before Reuse

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.