PT-2017-7857 · Arm · Arm Trusted Firmware

Publicado 2017-04-06 · Atualizado 2017-04-12 · CVE-2016-10319

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ARM Trusted Firmware versions 1.2 through 1.3

Description The issue arises from a malformed firmware update SMC that can cause integer overflows, leading to the copying of unexpectedly large data into secure memory. This occurs in specific scenarios involving the execution of AArch64 Generic Trusted Firmware (TF) BL1 code and other firmware update code.

Recommendations For ARM Trusted Firmware versions 1.2 through 1.3, as a temporary workaround, consider restricting the execution of firmware update code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2016-10319

Produtos afetados

Arm Trusted Firmware

Referências · 3

• https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-1 · Correção
• https://osv.dev/vulnerability/CVE-2016-10319 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10319 · Nota de Segurança