CVE-2021-43619

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://developer.arm.com/support/arm-security-updatesVendor Advisory
https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/Patch, Third Party Advisory
https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/fwu_write_vulnerability.htmlExploit, Patch, Third Party Advisory
https://www.trustedfirmware.orgProduct
https://developer.arm.com/support/arm-security-updatesVendor Advisory
https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/Patch, Third Party Advisory
https://tf-m-user-guide.trustedfirmware.org/docs/security/security_advisories/fwu_write_vulnerability.htmlExploit, Patch, Third Party Advisory
https://www.trustedfirmware.orgProduct

Timeline

Published: Mar 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-43629.8The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_CVE-2021-436207.5An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affecte CVE-2021-436289.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.CVE-2021-436299.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.CVE-2021-43636.1The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due CVE-2021-436308.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an aut CVE-2021-436319.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php.CVE-2021-436335.4Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will b CVE-2021-436356.1A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execut CVE-2021-436369.8Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing hos CVE-2021-436378.8Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local CVE-2021-436388.8Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allo