ARM Trusted Firmware up to 1.3 BL1 FWU SMC integer overflow

Summaryinfo

A vulnerability described as critical has been identified in ARM Trusted Firmware up to 1.3. Affected by this issue is some unknown functionality of the component BL1 FWU SMC Handler. Executing a manipulation can lead to integer overflow. This vulnerability appears as CVE-2017-9607. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in ARM Trusted Firmware up to 1.3 (Firmware Software) and classified as critical. This vulnerability affects an unknown code block of the component BL1 FWU SMC Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the bl1_plat_mem_check protection mechanism, cause a denial of service, or possibly have unspecified other impact via a crafted AArch32 image, which triggers an integer overflow.

The bug was discovered 06/13/2017. The weakness was presented 09/20/2017 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability was named CVE-2017-9607 since 06/13/2017. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 99 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firmware Software

Vendor

• ARM

Name

• Trusted Firmware

Version

• 1.0
• 1.1
• 1.2
• 1.3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion