CVE-2024-0151 Other in Arm v8-M Security Extensions Requirements on Development Tools
Attackers can pass out-of-range values to Secure state via insufficient argument checking in CMSE toolchains, potentially causing incorrect secure operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0151?
CVE-2024-0151 is a medium-severity vulnerability in Arm v8-M Security Extensions Requirements on Development Tools, published on 24 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.
Weakness: CWE-241
Which versions are affected by CVE-2024-0151?
How do I fix CVE-2024-0151?
No fix has been published for CVE-2024-0151 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0151 being exploited?
There is no known exploitation of CVE-2024-0151 in the wild and no public exploit code.
Sources
Also known as GHSA-gcfv-8g7p-w74j.