PT-2017-7857 · Arm · Arm Trusted Firmware

Published 2017-04-06 · Updated 2017-04-12 · CVE-2016-10319

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ARM Trusted Firmware versions 1.2 through 1.3

Description The issue arises from a malformed firmware update SMC that can cause integer overflows, leading to the copying of unexpectedly large data into secure memory. This occurs in specific scenarios involving the execution of AArch64 Generic Trusted Firmware (TF) BL1 code and other firmware update code.

Recommendations For ARM Trusted Firmware versions 1.2 through 1.3, as a temporary workaround, consider restricting the execution of firmware update code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2016-10319

Affected Products

Arm Trusted Firmware

References · 3

• https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-1 · Patch
• https://osv.dev/vulnerability/CVE-2016-10319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10319 · Security Note