CVE-2024-6564 — MEDIUM (6.7)

Vulnerability Description

Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.

CVSS Score

6.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Renesas	Arm-Trusted-Firmware	-

Related Weaknesses (CWE)

CWE-120

References

https://asrg.io/security-advisories/cve-2024-6564/Third Party Advisory
https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660cPatch
https://asrg.io/security-advisories/cve-2024-6564/Third Party Advisory
https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb3558410032d2660cPatch

FAQ

What is CVE-2024-6564?

CVE-2024-6564 is a vulnerability with a CVSS score of 6.7 (MEDIUM). Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of ...

How severe is CVE-2024-6564?

CVE-2024-6564 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-6564?

Check the references section above for vendor advisories and patch information. Affected products include: Renesas Arm-Trusted-Firmware.