CVE catalog

CVE-2024-5660

arm-trusted-firmware: CVE-2024-5660

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.56% · Oct 25, 2026

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianarm-trusted-firmwaresid2.12.16+dfsg-1fixed
Debianarm-trusted-firmwareforky2.12.16+dfsg-1fixed
Debianarm-trusted-firmwaretrixie2.12.1+dfsg-1fixed
Debianarm-trusted-firmwarebookworm2.8.0+dfsg-1vulnerable
Alpinearm-trusted-firmware3.182.8.32-r0fixed
Alpinearm-trusted-firmware3.192.8.32-r0fixed
Alpinearm-trusted-firmware3.202.8.32-r0fixed
Alpinearm-trusted-firmware3.212.8.32-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianarm-trusted-firmwaresourcesid2.12.1+dfsg-1not yet assignedNot reportedNot reported
Debianarm-trusted-firmwaresourceforky2.12.1+dfsg-1not yet assignedNot reportedNot reported
Debianarm-trusted-firmwaresourcetrixie2.12.1+dfsg-1not yet assignedNot reportedNot reported
Debianarm-trusted-firmwaresourcebookworm(unfixed)not yet assignedNot reportedNot reported
Alpinearm-trusted-firmwareapk3.182.8.32-r0Not reportedALPINE-CVE-2024-5660Not reported
Alpinearm-trusted-firmwareapk3.192.8.32-r0Not reportedALPINE-CVE-2024-5660Not reported
Alpinearm-trusted-firmwareapk3.202.8.32-r0Not reportedALPINE-CVE-2024-5660Not reported
Alpinearm-trusted-firmwareapk3.212.8.32-r0Not reportedALPINE-CVE-2024-5660Not reported

Notes

[bookworm] arm-trusted-firmware: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [arm-trusted-firmware]Affected
    Details (1)

    • 2.8.0+dfsg-1 · arm64 · bookworm

      Affected

      dsa · arm-trusted-firmware · debian · bookworm; dsa · arm-trusted-firmware · debian · 12

  • [arm-trusted-firmware-tools]Affected

    Source package: [arm-trusted-firmware]

    Details (2)

    • 2.8.0+dfsg-1 · amd64 · bookworm

      Affected

      dsa · arm-trusted-firmware · debian · bookworm; dsa · arm-trusted-firmware · debian · 12

    • 2.8.0+dfsg-1 · arm64 · bookworm

      Affected

      dsa · arm-trusted-firmware · debian · bookworm; dsa · arm-trusted-firmware · debian · 12

[Debian 13 (Trixie)]

  • [arm-trusted-firmware]Fixed
    Details (1)

    • 2.12.1+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.12.1+dfsg-1

      dsa · arm-trusted-firmware · debian · 13

  • [arm-trusted-firmware-tools]Fixed

    Source package: [arm-trusted-firmware]

    Details (2)

    • 2.12.1+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.12.1+dfsg-1

      dsa · arm-trusted-firmware · debian · 13

    • 2.12.1+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.12.1+dfsg-1

      dsa · arm-trusted-firmware · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]