CVE-2024-0151
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-0151 is a medium-severity Improper Handling of Unexpected Data Type (CWE-241) vulnerability in Arm (inferred from references). Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-15950
Vulnerability Data
Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass…
more
values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation explicitly checks that supplied data matches expected types and rejects mismatches before they reach processing logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and type checking to prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing, developer training) that reach a minority slice of CWE-241 instances (those introduced via missing type checks in first-party code) but leave most production defects untouched when practices are not exhaustive.
Application security requirements typically mandate strong input validation and type enforcement to prevent malformed data processing.
A.8.27 mandates security-by-design principles (e.g. distrust external input, data validation/sanitization, secure architecture review against attack patterns) that reach type-handling defects in some but not all cases; a bounded remainder (e.g. custom parsing logic or third-party libraries) can still introduce the weakness and allow exploitation.