Information Leak in ARM Trusted Firmware
CVE-2017-15031

7.5HIGH

Key Information:

Vendor

Arm
Status
Arm-trusted-firmware
Vendor
CVE Published:
18 December 2018

What is CVE-2017-15031?

The vulnerability in ARM Trusted Firmware arises from the failure to properly initialize and maintain the PMCR_EL0 register across various versions up to v1.4. This oversight can potentially lead to the leakage of secure world timing information, posing a risk to sensitive operations and overall system security. It is crucial for users of affected versions to review their configurations and implement the necessary updates to mitigate the risk.

References

https://github.com/ARM-software/arm-trusted-firmware/wiki...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/106271
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.