Fluid Attacks Database

Description

In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing information.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 12	arm-trusted-firmware	=2.10.0+dfsg-1 \|\| =2.10.10+dfsg-1 \|\| =2.12.0+dfsg-1 \|\| =2.12.0+dfsg-2 \|\| =2.12.1+dfsg-1 \|\| =2.12.16+dfsg-1 \|\| =2.8.0+dfsg-1 \|\| =2.9.0+dfsg-1 \|\| =2.9.0+dfsg-2 \|\| =2.9.0+dfsg-3
debian 13	arm-trusted-firmware	=2.12.1+dfsg-1 \|\| =2.12.16+dfsg-1
debian 14	arm-trusted-firmware	=2.12.1+dfsg-1 \|\| =2.12.16+dfsg-1

Aliases

1. CVE-2017-150312. NVD-2017-150313. OSV-DEBIAN-2017-150314. OSV-2017-150315. SECURITY-TRACKER-CVE-2017-15031

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.