Vulnerability-Lookup

CVE-2024-6564 (GCVE-0-2024-6564)

Vulnerability from cvelistv5 – Published: 2024-07-08 15:18 – Updated: 2024-08-01 21:41

Title

Buffer overflow in Rensas RCAR

Summary

Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-09 15:14 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

ASRG icscert root

References

2 references

URL	Tags
https://github.com/renesas-rcar/arm-trusted-firmw…
https://asrg.io/security-advisories/cve-2024-6564/	third-party-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
Renesas	rcar_gen3_v2.5	Affected: c2f286820471ed276c57e603762bd831873e5a17 , ≤ c9fb3558410032d2660c7f3b7d4b87dec09fe2f2 (git)	guessed
renesas	rcar_gen3_v2.5	Affected: c2f286820471ed276c57e603762bd831873e5a17 , ≤ c9fb3558410032d2660c7f3b7d4b87dec09fe2f2 (custom) cpe:2.3:a:renesas:rcar_gen3_v2.5::::::::

Credits

Tomer Fichman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:renesas:rcar_gen3_v2.5:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rcar_gen3_v2.5",
            "vendor": "renesas",
            "versions": [
              {
                "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
                "status": "affected",
                "version": "c2f286820471ed276c57e603762bd831873e5a17",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6564",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T15:14:13.300448Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-09T15:17:54.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:41:03.762Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://asrg.io/security-advisories/cve-2024-6564/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "arm-trusted-firmware",
          "product": "rcar_gen3_v2.5",
          "programFiles": [
            "https://github.com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.c"
          ],
          "repo": "https://github.com/renesas-rcar/arm-trusted-firmware/",
          "vendor": "Renesas",
          "versions": [
            {
              "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
              "status": "affected",
              "version": "c2f286820471ed276c57e603762bd831873e5a17",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tomer Fichman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eBuffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-08T15:20:00.212Z",
        "orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
        "shortName": "ASRG"
      },
      "references": [
        {
          "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://asrg.io/security-advisories/cve-2024-6564/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Buffer overflow in Rensas RCAR",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
    "assignerShortName": "ASRG",
    "cveId": "CVE-2024-6564",
    "datePublished": "2024-07-08T15:18:17.265Z",
    "dateReserved": "2024-07-08T15:06:44.987Z",
    "dateUpdated": "2024-08-01T21:41:03.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-6564",
      "date": "2026-09-20",
      "epss": "0.00223",
      "percentile": "0.13154"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:renesas:arm-trusted-firmware:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "16A2BDC3-F664-4132-8148-9DB849240F8B",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot."
        },
        {
          "lang": "es",
          "value": "Desbordamiento del b\u00fafer en \"rcar_dev_init\" debido al uso de datos que no son de confianza (rcar_image_number) como contador de bucle antes de verificarlo con RCAR_MAX_BL3X_IMAGE. Esto podr\u00eda provocar una omisi\u00f3n total del arranque seguro."
        }
      ],
      "id": "CVE-2024-6564",
      "lastModified": "2024-11-21T09:49:53.680",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 0.8,
            "impactScore": 5.9,
            "source": "cve@asrg.io",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 0.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-07-08T16:15:09.423",
      "references": [
        {
          "source": "cve@asrg.io",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://asrg.io/security-advisories/cve-2024-6564/"
        },
        {
          "source": "cve@asrg.io",
          "tags": [
            "Patch"
          ],
          "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://asrg.io/security-advisories/cve-2024-6564/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
        }
      ],
      "sourceIdentifier": "cve@asrg.io",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-120"
            }
          ],
          "source": "cve@asrg.io",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-120"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "arm-trusted-firmware",
                "product": "rcar_gen3_v2.5",
                "programFiles": [
                  "https://github.com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.c"
                ],
                "repo": "https://github.com/renesas-rcar/arm-trusted-firmware/",
                "vendor": "Renesas",
                "versions": [
                  {
                    "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
                    "status": "affected",
                    "version": "c2f286820471ed276c57e603762bd831873e5a17",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "cve@asrg.io"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:renesas:rcar_gen3_v2.5:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "rcar_gen3_v2.5",
                "vendor": "renesas",
                "versions": [
                  {
                    "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
                    "status": "affected",
                    "version": "c2f286820471ed276c57e603762bd831873e5a17",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:renesas:arm-trusted-firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "16A2BDC3-F664-4132-8148-9DB849240F8B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot."
          },
          {
            "lang": "es",
            "value": "Desbordamiento del b\u00fafer en \"rcar_dev_init\" debido al uso de datos que no son de confianza (rcar_image_number) como contador de bucle antes de verificarlo con RCAR_MAX_BL3X_IMAGE. Esto podr\u00eda provocar una omisi\u00f3n total del arranque seguro."
          }
        ],
        "id": "CVE-2024-6564",
        "lastModified": "2026-06-17T08:18:15.117",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 5.9,
              "source": "cve@asrg.io",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-6564",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T15:14:13.300448Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-07-08T16:15:09.423",
        "references": [
          {
            "source": "cve@asrg.io",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://asrg.io/security-advisories/cve-2024-6564/"
          },
          {
            "source": "cve@asrg.io",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://asrg.io/security-advisories/cve-2024-6564/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
          }
        ],
        "sourceIdentifier": "cve@asrg.io",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-120"
              }
            ],
            "source": "cve@asrg.io",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-120"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:18:04+00:00",
      "cve": "CVE-2024-6564",
      "id": "CVE-2024-6564",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Buffer overflow in Rensas RCAR",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6564.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-01T01:14:27Z",
      "cve": "CVE-2024-6564",
      "id": "CVE-2024-6564",
      "initial_release_date": "2024-07-10T03:36:29Z",
      "product_status:known_not_affected": "34",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-6564",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-6564.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T21:41:03.762Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
              },
              {
                "tags": [
                  "third-party-advisory",
                  "x_transferred"
                ],
                "url": "https://asrg.io/security-advisories/cve-2024-6564/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:renesas:rcar_gen3_v2.5:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "rcar_gen3_v2.5",
                "vendor": "renesas",
                "versions": [
                  {
                    "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
                    "status": "affected",
                    "version": "c2f286820471ed276c57e603762bd831873e5a17",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-6564",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-09T15:14:13.300448Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-09T15:17:48.731Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "arm-trusted-firmware",
              "product": "rcar_gen3_v2.5",
              "programFiles": [
                "https://github.com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.c"
              ],
              "repo": "https://github.com/renesas-rcar/arm-trusted-firmware/",
              "vendor": "Renesas",
              "versions": [
                {
                  "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
                  "status": "affected",
                  "version": "c2f286820471ed276c57e603762bd831873e5a17",
                  "versionType": "git"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Tomer Fichman"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eBuffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.\u003c/span\u003e\u003cbr\u003e"
                }
              ],
              "value": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-120",
                  "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-07-08T15:20:00.212Z",
            "orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
            "shortName": "ASRG"
          },
          "references": [
            {
              "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://asrg.io/security-advisories/cve-2024-6564/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Buffer overflow in Rensas RCAR",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
        "assignerShortName": "ASRG",
        "cveId": "CVE-2024-6564",
        "datePublished": "2024-07-08T15:18:17.265Z",
        "dateReserved": "2024-07-08T15:06:44.987Z",
        "dateUpdated": "2024-08-01T21:41:03.762Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-6564

Vulnerability from fkie_nvd - Published: 2024-07-08 16:15 - Updated: 2026-06-17 08:18

Severity

6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cve@asrg.io	https://asrg.io/security-advisories/cve-2024-6564/	Third Party Advisory
cve@asrg.io	https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2	Patch
af854a3a-2127-422b-91ae-364da2661108	https://asrg.io/security-advisories/cve-2024-6564/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2	Patch

Impacted products

	Vendor	Product	Version
	renesas	arm-trusted-firmware	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "arm-trusted-firmware",
          "product": "rcar_gen3_v2.5",
          "programFiles": [
            "https://github.com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.c"
          ],
          "repo": "https://github.com/renesas-rcar/arm-trusted-firmware/",
          "vendor": "Renesas",
          "versions": [
            {
              "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
              "status": "affected",
              "version": "c2f286820471ed276c57e603762bd831873e5a17",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "cve@asrg.io"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:renesas:rcar_gen3_v2.5:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "rcar_gen3_v2.5",
          "vendor": "renesas",
          "versions": [
            {
              "lessThanOrEqual": "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2",
              "status": "affected",
              "version": "c2f286820471ed276c57e603762bd831873e5a17",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:renesas:arm-trusted-firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "16A2BDC3-F664-4132-8148-9DB849240F8B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot."
    },
    {
      "lang": "es",
      "value": "Desbordamiento del b\u00fafer en \"rcar_dev_init\" debido al uso de datos que no son de confianza (rcar_image_number) como contador de bucle antes de verificarlo con RCAR_MAX_BL3X_IMAGE. Esto podr\u00eda provocar una omisi\u00f3n total del arranque seguro."
    }
  ],
  "id": "CVE-2024-6564",
  "lastModified": "2026-06-17T08:18:15.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "cve@asrg.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6564",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-07-09T15:14:13.300448Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-07-08T16:15:09.423",
  "references": [
    {
      "source": "cve@asrg.io",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://asrg.io/security-advisories/cve-2024-6564/"
    },
    {
      "source": "cve@asrg.io",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://asrg.io/security-advisories/cve-2024-6564/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
    }
  ],
  "sourceIdentifier": "cve@asrg.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "cve@asrg.io",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4F2H-F89Q-3W95

Vulnerability from github – Published: 2024-07-08 18:31 – Updated: 2024-07-08 18:31

Details

Severity

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-6564"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-08T16:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.",
  "id": "GHSA-4f2h-f89q-3w95",
  "modified": "2024-07-08T18:31:18Z",
  "published": "2024-07-08T18:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6564"
    },
    {
      "type": "WEB",
      "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
    },
    {
      "type": "WEB",
      "url": "https://asrg.io/security-advisories/cve-2024-6564"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OESA-2024-1848 (CVE-2024-6563)

Vulnerability from osv_openeuler – Published: 2024-07-19 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

arm-trusted-firmware security update

Details

Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.

Security Fix(es):

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .

In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.(CVE-2024-6563)

Severity

6.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6563	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6564	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "arm-trusted-firmware-armv8-2.3-5.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "arm-trusted-firmware-2.3-5.oe2203sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "arm-trusted-firmware",
        "purl": "pkg:rpm/openEuler/arm-trusted-firmware\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3-5.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\r\n\r\nBuffer Copy without Checking Size of Input (\u0026apos;Classic Buffer Overflow\u0026apos;) vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .\r\n\r\n\r\n\r\n\nIn line 313 \u0026quot;addr_loaded_cnt\u0026quot; is checked not to be \u0026quot;CHECK_IMAGE_AREA_CNT\u0026quot; (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of \u0026quot;dst\u0026quot; will be written to the area immediately after the buffer, which is \u0026quot;addr_loaded_cnt\u0026quot;. This will allow an attacker to freely control the value of \u0026quot;addr_loaded_cnt\u0026quot; and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value (\u0026quot;len\u0026quot;) they desire.(CVE-2024-6563)\r\n\r\nBuffer overflow in \u0026quot;rcar_dev_init\u0026quot;  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.(CVE-2024-6564)",
  "id": "OESA-2024-1848",
  "modified": "2026-08-06T11:07:18Z",
  "published": "2024-07-19T11:07:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1848"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6563"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6564"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "arm-trusted-firmware security update",
  "upstream": [
    "CVE-2024-6563",
    "CVE-2024-6564"
  ]
}

OESA-2024-1849 (CVE-2024-6563)

Vulnerability from osv_openeuler – Published: 2024-07-19 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

arm-trusted-firmware security update

Details

Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.

Security Fix(es):

Severity

6.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6563	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6564	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "arm-trusted-firmware-armv8-2.3-5.oe2203sp1.aarch64.rpm"
        ],
        "src": [
          "arm-trusted-firmware-2.3-5.oe2203sp1.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP1",
        "name": "arm-trusted-firmware",
        "purl": "pkg:rpm/openEuler/arm-trusted-firmware\u0026distro=openEuler-22.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3-5.oe2203sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\r\n\r\nBuffer Copy without Checking Size of Input (\u0026apos;Classic Buffer Overflow\u0026apos;) vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .\r\n\r\n\r\n\r\n\nIn line 313 \u0026quot;addr_loaded_cnt\u0026quot; is checked not to be \u0026quot;CHECK_IMAGE_AREA_CNT\u0026quot; (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of \u0026quot;dst\u0026quot; will be written to the area immediately after the buffer, which is \u0026quot;addr_loaded_cnt\u0026quot;. This will allow an attacker to freely control the value of \u0026quot;addr_loaded_cnt\u0026quot; and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value (\u0026quot;len\u0026quot;) they desire.(CVE-2024-6563)\r\n\r\nBuffer overflow in \u0026quot;rcar_dev_init\u0026quot;  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.(CVE-2024-6564)",
  "id": "OESA-2024-1849",
  "modified": "2026-08-06T11:07:18Z",
  "published": "2024-07-19T11:07:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1849"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6563"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6564"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "arm-trusted-firmware security update",
  "upstream": [
    "CVE-2024-6563",
    "CVE-2024-6564"
  ]
}

OESA-2024-1850 (CVE-2024-6563)

Vulnerability from osv_openeuler – Published: 2024-07-19 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

arm-trusted-firmware security update

Details

Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.

Security Fix(es):

Severity

6.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6563	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6564	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "arm-trusted-firmware-armv8-2.3-5.oe2203sp3.aarch64.rpm"
        ],
        "src": [
          "arm-trusted-firmware-2.3-5.oe2203sp3.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "arm-trusted-firmware",
        "purl": "pkg:rpm/openEuler/arm-trusted-firmware\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3-5.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\r\n\r\nBuffer Copy without Checking Size of Input (\u0026apos;Classic Buffer Overflow\u0026apos;) vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .\r\n\r\n\r\n\r\n\nIn line 313 \u0026quot;addr_loaded_cnt\u0026quot; is checked not to be \u0026quot;CHECK_IMAGE_AREA_CNT\u0026quot; (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of \u0026quot;dst\u0026quot; will be written to the area immediately after the buffer, which is \u0026quot;addr_loaded_cnt\u0026quot;. This will allow an attacker to freely control the value of \u0026quot;addr_loaded_cnt\u0026quot; and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value (\u0026quot;len\u0026quot;) they desire.(CVE-2024-6563)\r\n\r\nBuffer overflow in \u0026quot;rcar_dev_init\u0026quot;  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.(CVE-2024-6564)",
  "id": "OESA-2024-1850",
  "modified": "2026-08-06T11:07:19Z",
  "published": "2024-07-19T11:07:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1850"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6563"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6564"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "arm-trusted-firmware security update",
  "upstream": [
    "CVE-2024-6563",
    "CVE-2024-6564"
  ]
}

OESA-2024-1851 (CVE-2024-6563)

Vulnerability from osv_openeuler – Published: 2024-07-19 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

arm-trusted-firmware security update

Details

Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.

Security Fix(es):

Severity

6.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6563	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-6564	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "arm-trusted-firmware-armv8-2.9-3.oe2403.aarch64.rpm"
        ],
        "src": [
          "arm-trusted-firmware-2.9-3.oe2403.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "arm-trusted-firmware",
        "purl": "pkg:rpm/openEuler/arm-trusted-firmware\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9-3.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\r\n\r\nBuffer Copy without Checking Size of Input (\u0026apos;Classic Buffer Overflow\u0026apos;) vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .\r\n\r\n\r\n\r\n\nIn line 313 \u0026quot;addr_loaded_cnt\u0026quot; is checked not to be \u0026quot;CHECK_IMAGE_AREA_CNT\u0026quot; (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of \u0026quot;dst\u0026quot; will be written to the area immediately after the buffer, which is \u0026quot;addr_loaded_cnt\u0026quot;. This will allow an attacker to freely control the value of \u0026quot;addr_loaded_cnt\u0026quot; and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value (\u0026quot;len\u0026quot;) they desire.(CVE-2024-6563)\r\n\r\nBuffer overflow in \u0026quot;rcar_dev_init\u0026quot;  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.(CVE-2024-6564)",
  "id": "OESA-2024-1851",
  "modified": "2026-08-06T11:07:19Z",
  "published": "2024-07-19T11:07:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1851"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6563"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6564"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "arm-trusted-firmware security update",
  "upstream": [
    "CVE-2024-6563",
    "CVE-2024-6564"
  ]
}

UBUNTU-CVE-2024-6564 (CVE-2024-6564)

Vulnerability from osv_ubuntu – Published: 2024-07-08 16:15 – Updated: 2026-05-20 15:07 – Source website

Details

Severity

6.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-6564	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-6564	REPORT
	https://github.com/renesas-rcar/arm-trusted-firmw…	REPORT
	https://asrg.io/security-advisories/cve-2024-6564/	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "arm-trusted-firmware",
            "binary_version": "2.2-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "arm-trusted-firmware",
        "purl": "pkg:deb/ubuntu/arm-trusted-firmware@2.2-2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1-3",
        "2.2-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "arm-trusted-firmware",
            "binary_version": "2.6+dfsg-1"
          },
          {
            "binary_name": "arm-trusted-firmware-tools",
            "binary_version": "2.6+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "arm-trusted-firmware",
        "purl": "pkg:deb/ubuntu/arm-trusted-firmware@2.6+dfsg-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5+dfsg-1",
        "2.6+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "arm-trusted-firmware",
            "binary_version": "2.10.0+dfsg-1build2"
          },
          {
            "binary_name": "arm-trusted-firmware-tools",
            "binary_version": "2.10.0+dfsg-1build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "arm-trusted-firmware",
        "purl": "pkg:deb/ubuntu/arm-trusted-firmware@2.10.0+dfsg-1build2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.0+dfsg-3",
        "2.10.0+dfsg-1",
        "2.10.0+dfsg-1build1",
        "2.10.0+dfsg-1build2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "arm-trusted-firmware",
            "binary_version": "2.10.0+dfsg-1build2"
          },
          {
            "binary_name": "arm-trusted-firmware-tools",
            "binary_version": "2.10.0+dfsg-1build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "arm-trusted-firmware",
        "purl": "pkg:deb/ubuntu/arm-trusted-firmware@2.10.0+dfsg-1build2?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.0+dfsg-1build2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "arm-trusted-firmware",
            "binary_version": "2.12.1+dfsg-1"
          },
          {
            "binary_name": "arm-trusted-firmware-tools",
            "binary_version": "2.12.1+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "arm-trusted-firmware",
        "purl": "pkg:deb/ubuntu/arm-trusted-firmware@2.12.1+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.0+dfsg-1build2",
        "2.12.1+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.",
  "id": "UBUNTU-CVE-2024-6564",
  "modified": "2026-05-20T15:07:27Z",
  "published": "2024-07-08T16:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-6564"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6564"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
    },
    {
      "type": "REPORT",
      "url": "https://asrg.io/security-advisories/cve-2024-6564/"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-6564"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-6564 (GCVE-0-2024-6564)

FKIE_CVE-2024-6564

GHSA-4F2H-F89Q-3W95

OESA-2024-1848 (CVE-2024-6563)

OESA-2024-1849 (CVE-2024-6563)

OESA-2024-1850 (CVE-2024-6563)

OESA-2024-1851 (CVE-2024-6563)

UBUNTU-CVE-2024-6564 (CVE-2024-6564)

Tags

Sightings

Nomenclature

Related by attack behaviour