CVE-2024-11863
📋 TL;DR
CVE-2024-11863 is a denial-of-service vulnerability in ARM SCP-Firmware where specially crafted SCMI messages can cause a Usage Fault and crash the System Control Processor. This affects systems using ARM SCP-Firmware up to version 2.15.0, potentially impacting embedded devices, servers, and IoT devices with ARM-based processors.
💻 Affected Systems
- ARM SCP-Firmware
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete SCP crash leading to system instability, loss of power/thermal management, and potential denial-of-service for the entire system.
Likely Case
System instability requiring reboot, temporary loss of power/thermal management functions, and potential service disruption.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized SCMI message injection.
🎯 Exploit Status
Exploitation requires ability to send crafted SCMI messages to the SCP, typically requiring some level of system access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SCP-Firmware release after 2.15.0
Vendor Advisory: https://developer.arm.com/Arm%20Security%20Center/SCP-Firmware%20Vulnerability%20CVE-2024-11863-11864
Restart Required: Yes
Instructions:
1. Check current SCP-Firmware version. 2. Obtain updated firmware from ARM or device manufacturer. 3. Apply firmware update following vendor instructions. 4. Reboot system to activate new firmware.
🔧 Temporary Workarounds
Restrict SCMI Access
allLimit which processes/users can send SCMI messages to the SCP
# Implementation varies by system - consult vendor documentation
Network Segmentation
allIsolate systems with vulnerable SCP-Firmware from untrusted networks
# Use firewall rules to restrict access to SCP management interfaces
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized SCMI message injection
- Monitor system logs for SCP crashes or unusual SCMI message patterns
🔍 How to Verify
Check if Vulnerable:
Check SCP-Firmware version via vendor-specific commands or system documentationCheck Version:
# Command varies by platform - consult vendor documentationVerify Fix Applied:
Verify SCP-Firmware version is greater than 2.15.0 and test system stability📡 Detection & Monitoring
Log Indicators:
- SCP crash logs
- Usage Fault errors
- Unexpected SCMI message patterns
Network Indicators:
- Unusual SCMI traffic patterns
- Multiple SCMI messages from single source
SIEM Query:
Example: 'event_type:scp_crash OR error_message:"Usage Fault"'