CVE-2024-6287 HIGH

CVE-2024-6287: Incorrect Address Range Calculations

Vendor Renesas
Product rcar_gen3_v2.5
Weakness CWE-682
Published June 24, 2024
Last update August 1, 2024

CVSS base score

7.5/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.

Key dates

02Disclosure timeline

June 24, 2024 CVE published
August 1, 2024 Record updated