CVE-2024-0151: Cortex-M CMSE Privilege Escalation Flaw

CVE-2024-0151 Overview

CVE-2024-0151 is an input validation vulnerability affecting software compiled with toolchains implementing the ARM v8-M Security Extensions Requirements on Development Tools prior to version 1.4. The vulnerability stems from insufficient argument checking in Secure state Entry functions when using Cortex-M Security Extensions (CMSE). An attacker can exploit this flaw to pass out-of-range values to Secure state for data types smaller than 32-bits, potentially leading to incorrect operations within the secure execution environment.

Critical Impact

Attackers can bypass security boundaries by passing malformed arguments to Secure state Entry functions, potentially compromising the integrity of secure operations in embedded systems using ARM Cortex-M processors.

Affected Products

• Software using Cortex-M Security Extensions (CMSE)
• Toolchains implementing 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4
• Embedded systems utilizing ARM v8-M architecture with TrustZone security features

Discovery Timeline

• 2024-04-24 - CVE-2024-0151 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0151

Vulnerability Analysis

This vulnerability falls under CWE-241 (Improper Handling of Unexpected Data Type). The core issue lies in how Secure state Entry functions validate arguments passed from Non-secure state to Secure state in ARM Cortex-M processors with TrustZone security extensions.

When software is compiled using affected toolchains, the generated code does not properly validate that arguments with data types smaller than 32-bits (such as int8_t, int16_t, uint8_t, or uint16_t) fall within their expected range. Since the ARM architecture uses 32-bit registers, values passed between security states are inherently 32-bit quantities. Without proper range checking, the upper bits of these registers may contain unexpected values that can influence secure state operations.

The network attack vector indicates this vulnerability could be triggered remotely in scenarios where network-received data is processed by secure functions, though exploitation requires complex conditions to be met.

Root Cause

The root cause is a deficiency in the toolchain's implementation of the ARM v8-M Security Extensions specification. Prior to version 1.4 of the specification, toolchains were not required to generate code that validates argument ranges for sub-32-bit data types at secure entry points. This allows Non-secure code to pass values that appear valid in the lower bits but contain malicious or unexpected data in the upper bits, which secure code may inadvertently process.

Attack Vector

An attacker operating from the Non-secure state can craft function calls to Secure state Entry functions with carefully chosen 32-bit register values. When the secure function expects a smaller data type (e.g., uint8_t), it may only examine the lower 8 bits, but subsequent operations might inadvertently use the full 32-bit value. This can lead to:

• Incorrect conditional branching in secure code
• Buffer operations using unexpected index values
• Security policy bypass through manipulated parameters
• Information disclosure from secure memory regions

The exploitation mechanism relies on the attacker having the ability to invoke secure functions from Non-secure code, which is a normal operation in TrustZone-enabled systems. See the ARM Security Center Overview for additional technical details on CMSE implementation.

Detection Methods for CVE-2024-0151

Indicators of Compromise

• Unexpected behavior in secure state functions when processing sub-32-bit data types
• Anomalous memory access patterns in TrustZone secure regions
• Security policy violations triggered by manipulated function parameters
• Logs showing secure function calls with parameter values outside expected ranges

Detection Strategies

• Audit compiled binaries for proper argument validation at secure entry points using static analysis tools
• Review toolchain version and verify compliance with ARM v8-M Security Extensions Requirements version 1.4 or later
• Implement runtime monitoring for secure function entry points to detect out-of-range argument values
• Use firmware integrity verification to detect unauthorized modifications to secure code

Monitoring Recommendations

• Enable logging of all Non-secure to Secure state transitions where available
• Monitor for unusual patterns in secure function invocations that may indicate exploitation attempts
• Implement anomaly detection for parameter values passed to secure entry functions
• Regularly audit secure code execution flow for unexpected branching or memory access patterns

How to Mitigate CVE-2024-0151

Immediate Actions Required

• Identify all firmware and software compiled with toolchains implementing ARM v8-M Security Extensions Requirements prior to version 1.4
• Upgrade development toolchains to versions compliant with specification version 1.4 or later
• Recompile affected firmware with the updated toolchain to ensure proper argument validation
• Conduct security review of secure entry functions that accept sub-32-bit data types

Patch Information

The mitigation for this vulnerability requires updating development toolchains to versions that implement the ARM v8-M Security Extensions Requirements on Development Tools version 1.4 or later. Once updated, affected software must be recompiled to include proper argument range checking in Secure state Entry functions. Consult your toolchain vendor for specific version information and update instructions. Reference the ARM Security Center for authoritative guidance.

Workarounds

• Manually implement argument range validation at the beginning of all Secure state Entry functions that accept sub-32-bit parameters
• Apply input masking to ensure only valid bits are used (e.g., value &= 0xFF for uint8_t parameters)
• Implement defense-in-depth measures within secure code to validate all assumptions about parameter ranges
• Consider using 32-bit data types at secure interfaces and performing explicit range validation within secure code

// Manual argument validation workaround for secure entry functions
// Add explicit range checking for sub-32-bit parameters

__attribute__((cmse_nonsecure_entry))
int32_t secure_function(uint8_t param) {
    // Manually validate parameter is within uint8_t range
    if (param > 0xFF) {
        return -1; // Error: out of range
    }
    // Mask to ensure only lower 8 bits are used
    uint8_t validated_param = param & 0xFF;
    
    // Continue with secure operations using validated_param
    // ...
}