Arm · Trusted Firmware
CVE-2021-27562
Arm Trusted Firmware Out-of-Bounds Write Vulnerability
What it is
In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.
CISA: Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
More exploited flaws from Arm
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 12, 2024 | Use-After-Free | Mali GPU Kernel Driver | High 7.4 | 0.8% |
| Oct 3, 2023 | Use-After-Free | Mali GPU Kernel Driver | Medium 5.5 | 1.1% |
| Jul 7, 2023 | Mali GPU Kernel Driver Use-After-Free | Mali Graphics Processing Unit (GPU) | High 8.8 | 3.0% |
| Apr 7, 2023 | Mali GPU Kernel Driver Information Disclosure | Mali Graphics Processing Unit (GPU) | Low 3.3 | 1.2% |
| Mar 30, 2023 | Mali GPU Kernel Driver Unspecified | Mali Graphics Processing Unit (GPU) | High 7.8 | 1.1% |
| Mar 30, 2023 | Mali GPU Kernel Driver Use-After-Free | Mali Graphics Processing Unit (GPU) | High 8.8 | 18% |
| Nov 3, 2021 | Use-After-Free | Mali Graphics Processing Unit (GPU) | High 8.8 | 12% |
| Nov 3, 2021 | Unspecified | Mali Graphics Processing Unit (GPU) | High 8.8 | 5.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.