-
Notifications
You must be signed in to change notification settings - Fork 168
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 1 new CVEs: CVE-2024-7883 - 3 updated CVEs: CVE-2023-45896, CVE-2024-46528, CVE-2024-51430
- Loading branch information
cvelistV5 Github Action
committed
Oct 31, 2024
1 parent
5be7962
commit 23f73fd
Showing
6 changed files
with
370 additions
and
68 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,197 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-7883", | ||
| "assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "Arm", | ||
| "dateReserved": "2024-08-16T15:09:09.866Z", | ||
| "datePublished": "2024-10-31T17:01:49.725Z", | ||
| "dateUpdated": "2024-10-31T17:01:49.725Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "affected": [ | ||
| { | ||
| "defaultStatus": "unaffected", | ||
| "product": "Arm Compiler for Embedded", | ||
| "vendor": "Arm Ltd", | ||
| "versions": [ | ||
| { | ||
| "changes": [ | ||
| { | ||
| "at": "6.23", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "lessThanOrEqual": "6.22", | ||
| "status": "affected", | ||
| "version": "6.6", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "defaultStatus": "affected", | ||
| "platforms": [ | ||
| "Windows", | ||
| "Linux", | ||
| "ARM" | ||
| ], | ||
| "product": "Arm Compiler for Embedded FuSa 6.16LTS", | ||
| "vendor": "Arm Ltd", | ||
| "versions": [ | ||
| { | ||
| "status": "affected", | ||
| "version": "All versions" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "defaultStatus": "affected", | ||
| "product": "Arm Compiler for Embedded FuSa 6.21", | ||
| "vendor": "Arm Ltd", | ||
| "versions": [ | ||
| { | ||
| "status": "affected", | ||
| "version": "All versions" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "defaultStatus": "affected", | ||
| "platforms": [ | ||
| "Windows", | ||
| "Linux", | ||
| "ARM" | ||
| ], | ||
| "product": "Arm Compiler for Functional Safety 6.6", | ||
| "vendor": "Arm Ltd", | ||
| "versions": [ | ||
| { | ||
| "status": "affected", | ||
| "version": "All versions" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "defaultStatus": "unaffected", | ||
| "platforms": [ | ||
| "Windows", | ||
| "Linux", | ||
| "ARM" | ||
| ], | ||
| "product": "CLang", | ||
| "vendor": "Arm Ltd", | ||
| "versions": [ | ||
| { | ||
| "changes": [ | ||
| { | ||
| "at": "20", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "lessThanOrEqual": "19", | ||
| "status": "affected", | ||
| "version": "13", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "datePublic": "2024-10-31T16:00:00.000Z", | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "When using Arm Cortex-M Security Extensions (CMSE), Secure stack \ncontents can be leaked to Non-secure state via floating-point registers \nwhen a Secure to Non-secure function call is made that returns a \nfloating-point value and when this is the first use of floating-point \nsince entering Secure state. This allows an attacker to read a limited \nquantity of Secure stack contents with an impact on confidentiality. \nThis issue is specific to code generated using LLVM-based compilers." | ||
| } | ||
| ], | ||
| "value": "When using Arm Cortex-M Security Extensions (CMSE), Secure stack \ncontents can be leaked to Non-secure state via floating-point registers \nwhen a Secure to Non-secure function call is made that returns a \nfloating-point value and when this is the first use of floating-point \nsince entering Secure state. This allows an attacker to read a limited \nquantity of Secure stack contents with an impact on confidentiality. \nThis issue is specific to code generated using LLVM-based compilers." | ||
| } | ||
| ], | ||
| "impacts": [ | ||
| { | ||
| "capecId": "CAPEC-37", | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CAPEC-37 Retrieve Embedded Sensitive Data" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "HIGH", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 3.7, | ||
| "baseSeverity": "LOW", | ||
| "confidentialityImpact": "LOW", | ||
| "integrityImpact": "NONE", | ||
| "privilegesRequired": "NONE", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-226", | ||
| "description": "CWE-226 Sensitive Information in Resource Not Removed Before Reuse", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "56a131ea-b967-4a0d-a41e-5f3549952846", | ||
| "shortName": "Arm", | ||
| "dateUpdated": "2024-10-31T17:01:49.725Z" | ||
| }, | ||
| "references": [ | ||
| { | ||
| "url": "https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions%20Vulnerability" | ||
| } | ||
| ], | ||
| "solutions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "Recompile affected code using a fixed compiler.\n\n<br>" | ||
| } | ||
| ], | ||
| "value": "Recompile affected code using a fixed compiler." | ||
| } | ||
| ], | ||
| "source": { | ||
| "discovery": "INTERNAL" | ||
| }, | ||
| "title": "CMSE secure state may leak from stack to floating-point registers", | ||
| "x_generator": { | ||
| "engine": "Vulnogram 0.2.0" | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.