CVE-2024-6563

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6563
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6563.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6563
Downstream
DEBIAN (1)
OESA (4)
UBUNTU (1)
Published
2024-07-08T15:09:51Z
Modified
2026-10-21T02:51:54Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Buffer Overflow Arbitrary Write
Details

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .

In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.

Database specific 
{
    "cna_assigner":  "ASRG",
    "cwe_ids":  [
        "CWE-120",
        "CWE-123"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6563.json"
}
References

Affected packages

Git / github.com/renesas-rcar/arm-trusted-firmware/

Affected ranges

Type
GIT
Repo
https://github.com/renesas-rcar/arm-trusted-firmware/
Events
Introduced
c2f286820471ed276c57e603762bd831873e5a17
Last Affected
c9fb3558410032d2660c7f3b7d4b87dec09fe2f2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "c2f286820471ed276c57e603762bd831873e5a17"
                },
                {
                    "last_affected":  "c9fb3558410032d2660c7f3b7d4b87dec09fe2f2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6563.json"