CVE-2022-43701 Insecure directory permissions on installer files
Attackers can execute malicious code if installation directory permissions are not restrictive, affecting Arm development tools.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-43701?
CVE-2022-43701 is a high-severity vulnerability in Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS), published on 27 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
Weakness: CWE-276
Which versions are affected by CVE-2022-43701?
It affects 11 products.
Products include Arm Arm Compiler, Arm Arm Compiler for Embedded Fusa, Arm Arm Compiler for Functional Safety, Arm Arm Development Studio, Arm Arm Mobile Studio, Arm Ds Development Studio and 5 more.
How do I fix CVE-2022-43701?
No fix has been published for CVE-2022-43701 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-43701 being exploited?
There is no known exploitation of CVE-2022-43701 in the wild and no public exploit code.
Other vulnerabilities in Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)
Sources
Also known as GHSA-f7p2-4f5g-hfv9.