Login Request a demo
Medium severity · published Jun 9, 2021
CVE-2021-26314
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating…
5.5
CVSS
0.6%
EPSS
No
On KEV
Description
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bcm2711 · Broadcom
All versions, or not specified · source: NVD
CI
Core I7-10700k · Intel
All versions, or not specified · source: NVD
CI
Core I7-7700k · Intel
All versions, or not specified · source: NVD
CI
Core I9-9900k · Intel
All versions, or not specified · source: NVD
CO
Cortex-a72 · Arm
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
33; 34 · source: NVD
XE
Xen · Xen
All versions, or not specified · source: NVD
XS
Xeon Silver 4214 · Intel
All versions, or not specified · source: NVD
Affected product
CO
Cortex-a72
Arm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26314
Mailing List
http://www.openwall.com/lists/oss-security/2021/06/09/2
Exploit
http://www.openwall.com/lists/oss-security/2021/06/10/1
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003
More from Cortex-a72
5.5
CVE-2021-26313
Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions,…