CVE-2021-27562
Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Description
CVE-2021-27562 is a medium-severity vulnerability affecting Arm Trusted Firmware. Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 54.16% (98.0th percentile), this vulnerability has a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trustedfirmware | trusted firmware-m | <= 1.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://developer.arm.com/support/arm-security-updates(Vendor Advisory)
- https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/svc_caller_sp_fetching_vulnerability.rst(Permissions Required, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27562(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write (CWE-787) occurs when software writes data past the boundaries of the intended buffer. This can corrupt adjacent memory, crash the application, or allow an attacker to execute arbitrary code. Out-of-bounds write vulnerabilities are among the most commonly exploited weakness types and are frequently found in firmware and kernel-level components where memory safety is critical.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-27562 carries a CVSS 3.1 score of 5.5 (MEDIUM), indicating a moderate-severity threat. The vulnerability is exploitable locally with low attack complexity, requires low-level privileges, without user interaction. Successful exploitation can cause complete service disruption. Organizations running affected deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-27562 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 54.16% (98.0th percentile) indicates a very high probability of exploitation. While not currently associated with known ransomware campaigns, the confirmed exploitation status demands immediate attention. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (arm trusted firmware-m (<= 1.2.0)) have been updated to patched versions.
- If immediate patching is not possible, restrict local access on affected systems using access controls and least-privilege policies to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-27562 affects Arm Trusted Firmware. In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode. The attack vector is local-based, meaning an attacker needs local access to the target system to exploit this vulnerability. The CVSS score of 5.5 reflects the combination of low exploitability and moderate impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-27562 being actively exploited?
Yes. CVE-2021-27562 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 54.16% (98.0th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2021-27562?
CVE-2021-27562 affects Arm Trusted Firmware. Specifically affected products include: arm trusted firmware-m (<= 1.2.0).
How do I fix CVE-2021-27562?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement host-level mitigations to limit exposure.
How severe is CVE-2021-27562?
CVE-2021-27562 has a CVSS 3.1 score of 5.5 (MEDIUM). This is a medium-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.