High severity · published Jul 27, 2023
CVE-2022-43703
Incomplete verification of installation file signature
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) · Arm Ltd
AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases · source: vendor
AD
Arm Development Studio · Arm
All versions, or not specified · source: NVD
DD
DS Development Studio · Arm
5.0.0 through 5.29.3 · source: NVD
Affected product
AC
Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)
Arm Ltd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43703
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43703
Vendor Advisory
https://developer.arm.com/documentation/ka005596/latest
www.intel.com
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
More from Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)
7.8
CVE-2022-43702
Incomplete verification of installation file signature
7.8
CVE-2022-43701
Insecure directory permissions on installer files