CVE-2024-7883 CMSE secure state may leak from stack to floating-point registers
Attackers can read Secure stack contents via floating-point registers when using Arm CMSE with LLVM-based compilers, compromising confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7883?
CVE-2024-7883 is a low-severity vulnerability in Arm Compiler for Embedded, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.
Weakness: CWE-226
Which versions are affected by CVE-2024-7883?
It affects 4 products.
Products include Arm Arm Compiler for Embedded, Arm Arm Compiler for Embedded Fusa, Arm Arm Compiler for Functional Safety, Arm Clang.
How do I fix CVE-2024-7883?
Apply the vendor's patch.
Is CVE-2024-7883 being exploited?
There is no known exploitation of CVE-2024-7883 in the wild and no public exploit code.
Sources
Also known as AZL-53888, BELL-CVE-2024-7883, CLSA-2026-1791537402, DEBIAN-CVE-2024-7883, ECHO-5e0e-5634-4e9c, GHSA-vwj9-2733-p4wv and 5 more.