CVE-2024-11864: Arm SCP Firmware DOS Vulnerability

CVE-2024-11864 Overview

CVE-2024-11864 affects Arm System Control Processor (SCP) Firmware versions up to and including 2.15.0. Specifically crafted System Control and Management Interface (SCMI) messages sent to an SCP running vulnerable firmware trigger a Usage Fault and crash the SCP. The flaw is categorized under [CWE-755] (Improper Handling of Exceptional Conditions) and impacts availability of the system control processor. Arm published a security advisory addressing both CVE-2024-11863 and CVE-2024-11864 to guide downstream integrators on remediation.

Critical Impact
A remote attacker with the ability to deliver crafted SCMI messages can crash the SCP, disrupting power, clock, and performance management for the host system.

Affected Products

Arm SCP-Firmware versions up to and including 2.15.0
Systems integrating vulnerable SCP-Firmware as the System Control Processor
Downstream SoC platforms shipping affected SCP-Firmware builds

Discovery Timeline

2025-01-14 - CVE-2024-11864 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11864

Vulnerability Analysis

The vulnerability resides in how SCP-Firmware processes incoming SCMI messages. SCMI is the standardized interface used by application processors to request services from the SCP, including power domain control, clock management, performance scaling, and sensor access. When the firmware receives a malformed or unexpected SCMI message, it fails to handle the exceptional condition correctly. The result is a Usage Fault on the ARM processor running the SCP firmware, which crashes the SCP.

Because the SCP coordinates power, clock, and reset operations for the broader system, a crash of the SCP removes the platform's ability to manage these resources. The affected behavior maps to [CWE-755], which describes improper handling of exceptional conditions. No confidentiality or integrity impact is reported, but availability is significantly affected.

Root Cause

SCP-Firmware releases up to 2.15.0 contain insufficient validation and exception handling logic in the SCMI message parsing path. Specific malformed payloads reach code paths that trigger an ARM Usage Fault rather than being rejected with a proper SCMI error response. The firmware does not recover from the fault, leading to an SCP crash.

Attack Vector

The attack vector is the SCMI transport channel exposed to clients of the SCP. An attacker capable of issuing SCMI messages to the SCP, whether from the application processor side or from a network-reachable agent that proxies SCMI requests, can deliver the crafted message. Exploitation requires no authentication and no user interaction. The outcome is a denial-of-service condition against the SCP and, by extension, the platform that depends on it.

No public proof-of-concept exploit is available for CVE-2024-11864, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Arm Security Center Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-11864

Indicators of Compromise

Unexpected SCP resets or Usage Fault entries in platform firmware logs
Loss of power, clock, or performance management services on the host SoC following SCMI traffic
Anomalous SCMI message patterns originating from non-trusted agents or unexpected transport channels

Detection Strategies

Inspect SCMI transport logs for malformed or out-of-spec messages targeting the SCP
Correlate SCP fault traces with preceding SCMI command sequences to identify triggering payloads
Monitor system boot and runtime telemetry for repeated SCP recovery events that indicate exploitation attempts

Monitoring Recommendations

Forward platform firmware telemetry and SCP crash dumps to a central logging pipeline for analysis
Track SCP-Firmware version inventory across deployed devices to confirm exposure status
Alert on SCMI agents that deviate from expected message schemas defined by the SCMI specification

How to Mitigate CVE-2024-11864

Immediate Actions Required

Inventory all platforms running SCP-Firmware and identify any build at or below version 2.15.0
Apply the SCP-Firmware update published by Arm as referenced in the Arm Security Center Advisory
Restrict which agents can submit SCMI messages to the SCP, limiting the attack surface to trusted components

Patch Information

Arm has published a security advisory covering CVE-2024-11863 and CVE-2024-11864 that directs integrators to updated SCP-Firmware releases beyond 2.15.0. Downstream SoC vendors and platform integrators must rebuild and redistribute firmware images incorporating the fix. Consult the Arm Security Center Advisory for the exact remediated version applicable to your integration.

Workarounds

Constrain SCMI transport access so only authenticated, trusted firmware components can issue messages to the SCP
Validate SCMI payloads at any proxy or mailbox layer before forwarding them to the SCP
Disable optional SCMI protocols that are not required by the platform to reduce exposed code paths

bash

# Configuration example: verify deployed SCP-Firmware version
# Replace with the platform-specific command exposed by your vendor
cat /sys/firmware/scp/version
# Confirm the reported version is above 2.15.0 after applying the vendor patch