High severity · published Feb 27, 2017
CVE-2017-5926
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A6
A64 · Allwinner
All versions, or not specified · source: NVD
AI
Athlon II 640 X4 · Amd
All versions, or not specified · source: NVD
AC
Atom C2750 · Intel
All versions, or not specified · source: NVD
CN
Celeron N2840 · Intel
All versions, or not specified · source: NVD
CI
Core I5 M480 · Intel
All versions, or not specified · source: NVD
CI
Core I7 920 · Intel
All versions, or not specified · source: NVD
CI
Core I7-2620qm · Intel
All versions, or not specified · source: NVD
CI
Core I7-3632qm · Intel
All versions, or not specified · source: NVD
CI
Core I7-4500u · Intel
All versions, or not specified · source: NVD
CI
Core I7-6700k · Intel
All versions, or not specified · source: NVD
E3
E-350 · Amd
All versions, or not specified · source: NVD
E5
Exynos 5800 · Samsung
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5926
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5926
Exploit
http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
www.securityfocus.com
http://www.securityfocus.com/bid/96457
Exploit
https://www.vusec.net/projects/anc
More from A64
7.5
CVE-2017-5927
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM processors
7.5
CVE-2017-5925
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors