CVE-2024-0151CWE-241

Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains…

Medium · published April 24, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-241 · Improper Handling of Unexpected Data Type
Published
2024-04-24T17:12Z
EPSS history
Timeline
  • 24 APR 17:12Z
    Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains…
    cvelistv5