CVE-2024-2607

Description

The Mozilla Foundation Security Advisory describes this flaw as:

Return registers were overwritten which could have allowed an attacker to execute arbitrary code.

Note: This issue only affected Armv7-A systems. Other operating systems are unaffected.

Statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score7.5N/AN/A
Attack VectorNetworkN/AN/A
Attack ComplexityHighN/AN/A
Privileges RequiredNoneN/AN/A
User InteractionRequiredN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityHighN/AN/A
Integrity ImpactHighN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Understanding the Weakness (CWE)

CWE-1262

Confidentiality,Integrity

Technical Impact: Read Memory; Read Application Data; Modify Memory; Modify Application Data; Gain Privileges or Assume Identity; Bypass Protection Mechanism; Unexpected State; Alter Execution Logic

Confidentiality of hardware assets may be violated if the protected information can be read out by software through the register interface. Registers storing security state, settings, other security-critical data may be corruptible by software without correctly implemented protections.

Acknowledgements

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Gary Kwong as the original reporter.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.