PT-2017-17801 · Arm · Arm Trusted Firmware

Published 2017-06-07 · Updated 2026-06-08 · CVE-2017-7563

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARM Trusted Firmware version 1.3

Description The issue in ARM Trusted Firmware allows attackers to bypass the MT EXECUTE NEVER protection mechanism because RO memory is always executable at AArch64 Secure EL1. This is due to an inconsistency in the number of execute-never bits.

Recommendations For ARM Trusted Firmware version 1.3, consider disabling or restricting access to the execute-never bits mechanism as a temporary workaround until a patch is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-7563

Affected Products

Arm Trusted Firmware

References · 4

• https://osv.dev/vulnerability/CVE-2017-7563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7563 · Security Note
• https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-3 · Note
• https://t.me/cveNotify/166465 · Telegram Post