CVE-2016-10319
Last modified
CVE-2016-10319 is a vulnerability of currently unknown severity. In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory because of integer overflows. This affects certain cases involving execution of both AArch64 Generic Trusted Firmware (TF) BL1 code and other firmware update code.. EPSS estimates a 1.60% chance of exploitation in the next 30 days.
Description
In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory because of integer overflows. This affects certain cases involving execution of both AArch64 Generic Trusted Firmware (TF) BL1 code and other firmware update code.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Arm Trusted Firmware Project | Arm Trusted Firmware | 1.2 |
| Arm Trusted Firmware Project | Arm Trusted Firmware | 1.3 |
References
- https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-1Issue Tracking, Patch, VDB Entry
- https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-1Issue Tracking, Patch, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-10319?
How severe is CVE-2016-10319?
How do I fix CVE-2016-10319?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-10313Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (R…
- CVE-2016-10314Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (R…
- CVE-2016-10315Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (R…
- CVE-2016-10316Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (R…
- CVE-2016-10317The fill_threshhold_buffer function in base/gxht_thresh.c in…
- CVE-2016-10318A missing authorization check in the fscrypt_process_policy …
- CVE-2016-1032Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
- CVE-2016-10320textract before 1.5.0 allows OS Command Injection attacks vi…
- CVE-2016-10321web2py before 2.14.6 does not properly check if a host is de…
- CVE-2016-10322Synology Photo Station before 6.3-2958 allows remote authent…
- CVE-2016-10323Synology Photo Station before 6.3-2958 allows local users to…
- CVE-2016-10324In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can l…
Are you affected by CVE-2016-10319?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST