CVE-2024-5660CWE-668

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1…

Critical · published December 10, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

🔥 A hardware misconfiguration could let attackers slip past critical protections in ARM Cortex processors! Think of it like a malfunctioning security system at a high-tech museum that mistakenly lets in anyone with a staff pass — if the system misreads the access levels, unwanted visitors could roam free! This vulnerability could lead to unauthorized access to sensitive areas of memory, allowing attackers to manipulate data or execute malicious code. Imagine an intruder gaining full control over critical operations, potentially leading to devastating data breaches or system failures. The stakes are high!

Put simply

Think of it like a malfunctioning security system at a high-tech museum that mistakenly lets in anyone with a staff pass — if the system misreads the access levels, unwanted visitors could roam free! The use of Hardware Page Aggregation (HPA) combined with issues in Stage-1 or Stage-2 translation on certain ARM Cortex and Neoverse processors can allow attackers to bypass important memory protections, compromising system integrity and security.

What to do

This vulnerability could lead to unauthorized access to sensitive areas of memory, allowing attackers to manipulate data or execute malicious code. Imagine an intruder gaining full control over critical operations, potentially leading to devastating data breaches or system failures. The stakes are high! System administrators should immediately review and update firmware to mitigate this vulnerability, ensuring that all hardware configurations comply with the latest security standards. Additionally, monitor for any unusual activities that could indicate exploitation attempts. You've got this! Stay proactive, and with the right patches, you can keep your systems secure. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00556 · 45.6th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2024-12-10T13:55Z
EPSS history
Timeline
  • 10 DEC 13:55Z
    Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1…
    cvelistv5