CVE-2022-23960

MEDIUM5.6

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB

Published Mar 12, 2022

Modified 1 years ago

No fix available

Details

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.

References

WEBhttp://www.openwall.com/lists/oss-security/2022/03/18/2 WEBhttps://developer.arm.com/support/arm-security-updates WEBhttps://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability WEBhttps://lists.debian.org/debian-lts-announce/2022/07/msg00000.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2022-23960 ADVISORYhttps://www.debian.org/security/2022/dsa-5173

CVSS Analysis

CVSS v3.1

5.6

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.6/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Ecosystems

Timeline

PublishedMar 12, 2022

ModifiedAug 3, 2024