CVE-2024-5660 Security feature bypass in Cortex-78C
Attackers can bypass Stage-2 translation and GPT protection on specific Arm Cortex CPUs using Hardware Page Aggregation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5660?
CVE-2024-5660 is a critical vulnerability in Arm Cortex-78C, published on 10 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.
Weakness: CWE-668
Which versions are affected by CVE-2024-5660?
It affects 16 products.
Products include Arm Cortex-A710 Firmware, Arm Cortex-A77 Firmware, Arm Cortex-A78 Firmware, Arm Cortex-A78ae Firmware, Arm Cortex-A78c Firmware, Arm Cortex-X1 Firmware and 10 more.
How do I fix CVE-2024-5660?
Apply the vendor's patch.
Is CVE-2024-5660 being exploited?
There is no known exploitation of CVE-2024-5660 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-5660, DEBIAN-CVE-2024-5660, GHSA-h32q-4pph-8pgm, UBUNTU-CVE-2024-5660.