CVE-2024-7883: arm ltd arm compiler for embedded

Vulnerability summary

CVE-2024-7883 is a low (CVSS 3.7) vulnerability in arm ltd arm compiler for embedded. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-10-2024
   PublishedVulnerability first disclosed.
2. 31-10-2024
   Last modifiedVulnerability information updated.

Description

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.

• CWE-226Sensitive Information in Resource Not Removed Before ReuseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.