Medium severity · published Mar 12, 2022
CVE-2022-23960
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB
5.6
CVSS
0.5%
EPSS
No
On KEV
Description
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cortex-a57 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a65 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a65ae Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a710 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a72 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a73 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a75 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a76 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a76ae Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a77 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a78 Firmware · Arm
All versions, or not specified · source: NVD
CF
Cortex-a78ae Firmware · Arm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23960
Mailing List
http://www.openwall.com/lists/oss-security/2022/03/18/2
Vendor Advisory
https://developer.arm.com/support/arm-security-updates
Mitigation
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
Mailing List
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
Third Party Advisory
https://www.debian.org/security/2022/dsa-5173
More from Cortex-a57 Firmware
7.5
CVE-2022-48251
The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks
5.5
CVE-2020-13844
Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with…
5.1
CVE-2024-10929
In certain circumstances, an issue in Arm Cortex-A57, Cortex-A72 (revisions before r1p0), Cortex-A73 and Cortex-A75 may allow an adversary to gain a weak form of control over the…
4.7
CVE-2022-25368
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware…