CVE-2024-11263
Zephyrproject Zephyr ≤ 3.7.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-11263 is a critical-severity Privilege Context Switching Error (CWE-270) vulnerability in Zephyrproject Zephyr. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33714
Vulnerability Data
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V13.2.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces access authorizations according to policy at every request, structurally preventing incorrect privilege elevation or retention across context switches.
AC-6 requires least-privilege assignments and privilege minimization, reducing the opportunity for erroneous privilege state during context transitions.
AC-24 mandates that access-control decisions be made and enforced correctly for each request, directly addressing flawed privilege context switches.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorization policies and reviews directly prevents improper privilege changes across contexts.
Integrating secure-development practices catches and eliminates context-switching privilege errors during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining a topic-specific access control policy and requirements (with references to other controls); it does not itself enforce rules or stop a privilege context switching error from being present or exploited
A.5.18 governs the provisioning, review, and revocation of access rights granted to an already-authenticated identity; it has no bearing on whether the product itself correctly manages privilege transitions between contexts as described in CWE-270.
Restricting privileged utilities reduces exposure to context-switch privilege errors.
Privileged-access-rights control directly addresses improper privilege elevation during context switches.
Secure-SDLC practices can catch privilege-handling defects early but do not guarantee runtime correctness.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. blocks CWE-270