Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2024-7883

CMSE secure state may leak from stack to floating-point registers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Arm

Description

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arm Ltd Arm Compiler for Embedded

Default version status: unaffected

  • 6.6 to ≤ 6.22affected

Arm Ltd Arm Compiler for Embedded FuSa 6.16LTS

Default version status: affected

  • All versionsaffected

Arm Ltd Arm Compiler for Embedded FuSa 6.21

Default version status: affected

  • All versionsaffected

Arm Ltd Arm Compiler for Functional Safety 6.6

Default version status: affected

  • All versionsaffected

Arm Ltd CLang

Default version status: unaffected

  • 13 to ≤ 19affected

References