CVE-2020-16273

{"id": "CVE-2020-16273", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-11-12T19:15:14.583", "references": [{"url": "https://developer.arm.com/support/arm-security-updates/armv8-m-stack-sealing", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "In Arm software implementing the Armv8-M processors (all versions), the stack selection mechanism could be influenced by a stack-underflow attack in v8-M TrustZone based processors. An attacker can cause a change to the stack pointer used by the Secure World from a non-secure application if the stack is not initialized. This vulnerability affects only the software that is based on Armv8-M processors with the Security Extension."}, {"lang": "es", "value": "En el software Arm que implementa los procesadores Armv8-M (todas las versiones), el mecanismo de selecci\u00f3n de pila podr\u00eda estar influenciado por un ataque de subdesbordamiento de pila en los procesadores basados ??en TrustZone v8-M. Un atacante puede causar un cambio en el puntero de pila usado por Secure World desde una aplicaci\u00f3n no segura si la pila no est\u00e1 inicializada. Esta vulnerabilidad afecta solo al software que se basa en procesadores Armv8-M con la Security Extension"}], "lastModified": "2020-12-01T19:37:45.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arm:armv8-m_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C074E97-5B10-40DC-B412-FBC2EE869816"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arm:armv8-m:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7C7D2C39-E6D8-488C-B9C6-45F90A7CD294"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}