Arm Trusted Firmware Out-of-Bounds Write Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03

[ Description ]Official description

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.

CISA: Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Nov 2021): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• developer.arm.com/support/arm-security-updatesVendor Advisory
• git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisor…Permissions RequiredThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource