TI-2024-00140 Aliases CVE-2024-0151 GHSA-gcfv-8g7p-w74j

Insufficient argument checking in Secure state Entry functions in software using Cortex-M…

LOW 31CWE-241Published 2024-04-24 · Updated 2024-08-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00448 39th percentileScored 2026-11-07

Fix Fixed Arm v8-M Security Extensions Requirements on Development Tools (Arm): 1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Arm	Arm v8-M Security Extensions Requirements on Development Tools	1.0 to before 1.4	1.4	Patch available	CNA

Arm v8-M Security Extensions Requirements on Development Tools VendorArm Affected 1.0 to before 1.4 Fixed in 1.4 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:h:arm:armv8-m::::::::	—	—	Arm

cpe:2.3:h:arm:armv8-m:*:*:*:*:*:*:*:* Versions — — ·Arm

Remediation

Fix · CNA Arm v8-M Security Extensions Requirements on Development Tools (Arm) Fixed in 1.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2024-0151
2026-10-03 Alias added: GHSA-gcfv-8g7p-w74j

References

Other 1

https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions

TI-2022-17875 The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because… KEVCVSS 3.1HIGH 8.8
TI-2021-10068 . KEVCVSS 3.1HIGH 8.8
TI-2021-09732 The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory… KEVCVSS 3.1HIGH 8.8
TI-2021-09731 The Arm Mali GPU kernel driver allows privilege escalation or information disclosure… KEVCVSS 3.1HIGH 8.8
TI-2024-04292 Mali GPU Kernel Driver allows improper GPU memory processing operations KEVCVSS 3.1HIGH 7.8
TI-2022-06958 Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to… KEVCVSS 3.1HIGH 7.8

See all 174 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences