CVE-2024-7883
Low
Description
When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.
SeverityLow
CVSS3.7
Exploit probability—
Product
Arm Compiler For Embedded
PublishedOct 31, 2024
First seenOct 31, 2024
Weakness typeCWE-226CWE-226
How to fix
Update
- arm arm_compiler_for_embedded6.23 or later
- arm clang20.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arm arm_compiler_for_embedded | 6.6 ≤ v < 6.23 | 6.23 |
| arm arm_compiler_for_embedded_fusa | 6.16, 6.21 | — |
| arm arm_compiler_for_functional_safety | 6.6 | — |
| arm clang | 11.0.0 ≤ v < 20.1.0 | 20.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.