Bug 1226927 (CVE-2024-6287) - VUL-0: CVE-2024-6287: arm-trusted-firmware: incorrect calculation when checking whether a new image invades/overlaps with a previously loaded image
Summary: VUL-0: CVE-2024-6287: arm-trusted-firmware: incorrect calculation when checki...
Status: NEW
Alias: CVE-2024-6287
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/411986/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-6287:7.5:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-24 18:45 UTC by SMASH SMASH
Modified: 2024-07-15 08:34 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-24 18:45:57 UTC 
Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.


When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6287
https://www.cve.org/CVERecord?id=CVE-2024-6287
https://asrg.io/security-advisories/cve-2024-6287/
https://github.com/renesas-rcar/arm-trusted-firmware/commit/954d488a9798f8fda675c6b57c571b469b298f04
Comment 2 Ivan Ivanov 2024-06-25 06:15:57 UTC 
The only TF-A package wich we distribute is using upstream repository [1],[2].
Further we officially distribute TF-A package for RPi4 [3] only, because of
device constraints.

Firmware, TF-A in this case, is supposed to be distributed by 
platform/device vendors.

So I whould say that we are not affected.

[1] https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
[2] https://build.opensuse.org/package/show/hardware:boot/arm-trusted-firmware
[3] arm-trusted-firmware:rpi4