CVE-2021-27562: Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Summary: CVE-2021-27562 is an out-of-bounds write in Arm Trusted Firmware that lets the non-secure world trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. The vulnerability affects Yealink Device Management servers, and CISA set a remediation due date of 2021-11-17; known ransomware campaign use is listed as unknown.
What's compelling: The flaw crosses the boundary the firmware exists to enforce, letting non-secure code reach secure data on Yealink Device Management servers - and CISA's own entry records no known ransomware use, which means the absence of that signal is not evidence of safety.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- ArmCVE-2021-27562
- Related
- CVE-2024-4610: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jun 12, 2024CVE-2023-4211: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability Known Exploited Vulnerabilities · Oct 03, 2023CVE-2021-29256: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jul 07, 2023