Critical severity · published Oct 9, 2024
CVE-2024-45746
An issue was discovered in Trusted Firmware-M through 2.1.0
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Trusted Firmware-m · Trustedfirmware
1.6.0 through 2.1.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45746
trustedfirmware-m.readthedocs.io
https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/user_pointers_mailbox_vectors_vulnerability.html
www.trustedfirmware.org
https://www.trustedfirmware.org/projects/tf-m/
More from Trusted Firmware-m
5.5
CVE-2021-27562
Arm Trusted Firmware Out-of-Bounds Write Vulnerability
7.8
CVE-2021-43619
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition
7.5
CVE-2023-40271
In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the…
7.5
CVE-2021-32032
In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abort() operation in the…
7.0
CVE-2026-54467
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer