Skip to content
OpenAdvisories
High · 7.5 CVE-2024-6287 EUVD-2024-47405GHSA-gwvv-gr8w-ggvq

Incorrect Address Range Calculations

Published Jun 24, 2024 · Updated Aug 1, 2024 · Assigned by ASRG

Description

Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.

When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.

Affected products

VendorProductAffectedFixed
Renesas rcar_gen3_v2.5 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 arm-trusted-firmware No fix yet —
Debian 13 arm-trusted-firmware No fix yet —
Debian 12 arm-trusted-firmware No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 arm-trusted-firmware No fix yet —
Ubuntu 26.04 LTS arm-trusted-firmware No fix yet —
Ubuntu 25.10 arm-trusted-firmware No fix yet —

References