High severity · published Jul 27, 2023
CVE-2022-43701
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Arm Compiler · Arm
5.00 through 5.06; 6.00 before 6.20 · source: NVD
AC
Arm Compiler For Embedded Fusa · Arm
6.16 · source: NVD
AC
Arm Compiler For Functional Safety · Arm
6.6 · source: NVD
AD
Arm Development Studio · Arm
All versions, or not specified · source: NVD
AM
Arm Mobile Studio · Arm
All versions, or not specified · source: NVD
DD
DS Development Studio · Arm
5.0.0 through 5.29.3 · source: NVD
FM
Fast Models · Arm
All versions, or not specified · source: NVD
GT
Gnu Toolchain · Arm
All versions, or not specified · source: NVD
KM
Keil Mdk · Arm
All versions, or not specified · source: NVD
LF
Linaro Forge · Arm
before 22.1 · source: NVD
MS
Mbed Studio · Arm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43701
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43701
Vendor Advisory
https://developer.arm.com/documentation/ka005596/latest
www.intel.com
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
More from Arm Compiler
7.8
CVE-2022-43702
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code
7.8
CVE-2020-24658
Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays