What is the CVSS score of CVE-2024-7883?

CVE-2024-7883 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2024-7883?

Yes, a public proof-of-concept exploit is available for CVE-2024-7883. Prioritise patching immediately. EPSS: 0.5%.

Arm Compiler For Embedded CVE-2024-7883

LOW

Sensitive Information in Resource Not Removed Before Reuse (CWE-226)

2024-10-31 arm-security@arm.com

Information Disclosure Arm Compiler For Embedded Arm Compiler For Embedded Fusa Arm Compiler For Functional Safety Clang

3.7

CVSS 3.1 · Vendor: arm

Severity by source

Vendor (arm) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (arm) · only source for this CVE.

CVSS VectorVendor: arm

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 31, 2024 - 17:15 cve.org

LOW 3.7

DescriptionCVE.org

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.

AnalysisAI

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-226. When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers. Affected products include: Arm Arm Compiler For Embedded, Arm Arm Compiler For Embedded Fusa, Arm Arm Compiler For Functional Safety, Arm Clang.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.