CVE-2024-6563

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6563
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C . In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://asrg.io/security-advisories/cve-2024-6563/ Third Party Advisory
https://github.com/renesas-rcar/arm-trusted-firmware/commit/235f85b654a031f7647e81b86fc8e4ffeb430164 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:renesas:arm-trusted-firmware:-:*:*:*:*:*:*:*
History

22 Aug 2024, 15:51

Type Values Removed Values Added
First Time Renesas
Renesas arm-trusted-firmware
CPE cpe:2.3:o:rensas:arm-trusted-firmware:-:*:*:*:*:*:*:* cpe:2.3:o:renesas:arm-trusted-firmware:-:*:*:*:*:*:*:*

09 Jul 2024, 14:19

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 6.7
First Time Rensas arm-trusted-firmware
Rensas
CPE cpe:2.3:o:rensas:arm-trusted-firmware:-:*:*:*:*:*:*:*
References () https://asrg.io/security-advisories/cve-2024-6563/ - () https://asrg.io/security-advisories/cve-2024-6563/ - Third Party Advisory
References () https://github.com/renesas-rcar/arm-trusted-firmware/commit/235f85b654a031f7647e81b86fc8e4ffeb430164 - () https://github.com/renesas-rcar/arm-trusted-firmware/commit/235f85b654a031f7647e81b86fc8e4ffeb430164 - Patch
Summary
  • (es) La vulnerabilidad de copia de búfer sin verificar el tamaño de la entrada ('desbordamiento de búfer clásico') en el firmware arm-trusted-de Renesas permite la ejecución local de código. Esta vulnerabilidad está asociada a archivos de programa https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com /renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C. En la línea 313 se verifica que "addr_loaded_cnt" no sea "CHECK_IMAGE_AREA_CNT" (5) o mayor; esta verificación no detiene la función. Inmediatamente después (línea 317) habrá un desbordamiento en el búfer y el valor de "dst" se escribirá en el área inmediatamente después del búfer, que es "addr_loaded_cnt". Esto permitirá a un atacante controlar libremente el valor de "addr_loaded_cnt" y así controlar el destino de la escritura inmediatamente después (línea 318). La escritura en la línea 318 será entonces totalmente controlada por dicho atacante, con cualquier dirección y cualquier valor ("len") que desee.

08 Jul 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-08 16:15

Updated : 2024-08-22 15:51

NVD link : CVE-2024-6563

Mitre link : CVE-2024-6563

CVE.ORG link : CVE-2024-6563

JSON object : View

Products Affected

renesas

  • arm-trusted-firmware
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-123

Write-what-where Condition