TI-2024-07306 Aliases CVE-2024-7883 GHSA-vwj9-2733-p4wv

CMSE secure state may leak from stack to floating-point registers

LOW 18CWE-226Published 2024-10-31 · Updated 2024-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state. This allows an attacker to read a limited quantity of Secure stack contents with an impact on confidentiality. This issue is specific to code generated using LLVM-based compilers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00468 40th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Arm	Arm Compiler for Embedded	6.6 – 6.22	—	No fix listed	CNA
Arm	Arm Compiler for Embedded FuSa 6.16LTS	All versions and later	—	No fix listed	CNA
Arm	Arm Compiler for Embedded FuSa 6.21	All versions and later	—	No fix listed	CNA
Arm	Arm Compiler for Functional Safety 6.6	All versions and later	—	No fix listed	CNA
Arm	CLang	13 – 19	—	No fix listed	CNA

Arm Compiler for Embedded VendorArm Affected 6.6 – 6.22 Fixed in — No fix listed CNA
Arm Compiler for Embedded FuSa 6.16LTS VendorArm Affected All versions and later Fixed in — No fix listed CNA
Arm Compiler for Embedded FuSa 6.21 VendorArm Affected All versions and later Fixed in — No fix listed CNA
Arm Compiler for Functional Safety 6.6 VendorArm Affected All versions and later Fixed in — No fix listed CNA
CLang VendorArm Affected 13 – 19 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:arm:arm_compiler_for_embedded::::::::	6.6 to before 6.23	Vulnerable	Arm
cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.16::::lts:::	6.16	Vulnerable	Arm
cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.21::::lts:::	6.21	Vulnerable	Arm
cpe:2.3:a:arm:arm_compiler_for_functional_safety:6.6:::::::*	6.6	Vulnerable	Arm
cpe:2.3:a:arm:clang::::::::	11.0.0 to before 20.1.0	Vulnerable	Arm

cpe:2.3:a:arm:arm_compiler_for_embedded:*:*:*:*:*:*:*:* Versions 6.6 to before 6.23 Vulnerable ·Arm
cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.16:*:*:*:lts:*:*:* Versions 6.16 Vulnerable ·Arm
cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.21:*:*:*:lts:*:*:* Versions 6.21 Vulnerable ·Arm
cpe:2.3:a:arm:arm_compiler_for_functional_safety:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·Arm
cpe:2.3:a:arm:clang:*:*:*:*:*:*:*:* Versions 11.0.0 to before 20.1.0 Vulnerable ·Arm

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2024-7883
2026-10-03 Alias added: GHSA-vwj9-2733-p4wv

References

Exploit 1

https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions%20Vulnerability

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences