CVE-2024-1633

Katalog CVE

CVSS 2.0 · Low EPSS 0,14%

Kerentanan Integer Overflow or Wraparound pada renesas arm-trusted-firmware. Skor CVSS 3.1 2.0 (Low) menurut NVD.

Deskripsi (NVD)

During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integer value, it can result to an integer overflow. An attacker can bypass memory range restriction and write data out of buffer bounds, which could result in bypass of secure boot. Affected git version from c2f286820471ed276c57e603762bd831873e5a17 until (not 

Rincian

Terbit di NVD

19 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.0 (Low), sumber NVD
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://asrg.io/security-advisories/CVE-2024-1633/ advisory pihak ketiga