CVE-2020-16273

In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the stack is not initialized. This vulnerability affects only the software that is based on Armv8-M processors with the Security Extension.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:arm:armv8-m:-:*:*:*:*:*:*:*

cpe:2.3:o:arm:armv8-m_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-11-12 19:15

Updated : 2020-12-01 19:37

NVD link : CVE-2020-16273

Mitre link : CVE-2020-16273

CVE.ORG link : CVE-2020-16273

JSON object : View

Products Affected

arm

armv8-m
armv8-m_firmware

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2020-16273", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-11-12T19:15:14.583", "references": [{"url": "https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the stack is not initialized. This vulnerability affects only the software that is based on Armv8-M processors with the Security Extension."}, {"lang": "es", "value": "En el software Arm que implementa los procesadores Armv8-M (todas las versiones), el mecanismo de selecci\u00f3n de pila podr\u00eda estar influenciado por un ataque de subdesbordamiento de pila en los procesadores basados ??en TrustZone v8-M. Un atacante puede causar un cambio en el puntero de pila usado por Secure World desde una aplicaci\u00f3n no segura si la pila no est\u00e1 inicializada. Esta vulnerabilidad afecta solo al software que se basa en procesadores Armv8-M con la Security Extension"}], "lastModified": "2020-12-01T19:37:45.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arm:armv8-m:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7C7D2C39-E6D8-488C-B9C6-45F90A7CD294"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:armv8-m_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C074E97-5B10-40DC-B412-FBC2EE869816"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

7.8 /10