CVE-2017-7563

HighCVSS 8.1

Published: 07/06/2017(UTC)Updated: 08/06/2026(UTC)Translated: 09/06/2026(UTC)NVD NIST

Summary

In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs due to inconsistency in the number of execute-never bits (one bit versus two bits).

Risk Assessment

Organizations may be exposed to attacks that exploit this vulnerability to execute unauthorized code in a secure environment. This could lead to serious security breaches.

Recommendation

It is recommended to update to a newer version of ARM Trusted Firmware that addresses this vulnerability. Additionally, conducting a security audit is advisable to minimize risks associated with this vulnerability.

Other vulnerabilities in ARM Trusted Firmware 1.3

CVE-2017-7564High
In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers.

Original NVD description (English source)

In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits (one bit versus two bits).