CVE-2021-27562mediumunder attackCWE-787

CVE-2021-27562

Published · Updated

Follow this CVE+ Monitor Trusted

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 5.5epss 3.1%
from disclosure to weapon
Published on NVDMay 25
CISA KEV+162d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in Arm Trusted Firmware M allows untrusted software running on the device to halt the system, overwrite protected security data, or leak sensitive information by improperly calling secure functions. This matters because it breaks the security boundary between trusted and untrusted code.

Technical detail

CWE-787 (out-of-bounds write) in NSPE handler mode permits non-secure world code to invoke secure functions with insufficient validation, enabling arbitrary write access to secure memory regions, data exfiltration, or denial of service. The vulnerability requires local access but does not mandate elevated privileges within the non-secure context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a