Buffer Overflow Arbitrary Write

Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C . In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.

Scores

EPSS (exploitation in 30 days)

0.21% · top 89% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-123: Write-what-where Condition (opens in a new tab)All about CWE-123 and its CVEs
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs

Affected products

• Renesas · rcar_gen3_v2.5

  • affected c2f286820471ed276c57e603762bd831873e5a17 – ≤ c9fb3558410032d2660c7f3b7d4b87dec09fe2f2

References (2)

• https://github.com/renesas-rcar/arm-trusted-firmware/commit/235f85b654a031f7647e81b86fc8e4ffeb430164 (opens in a new tab)x_transferred
• https://asrg.io/security-advisories/cve-2024-6563/ (opens in a new tab)third-party-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-6563](https://trackcve.app/badge/CVE-2024-6563.svg)](https://trackcve.app/cve/CVE-2024-6563)

Record last updated 1 Aug 2024, 21:41 UTC.