National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2017-5754 Detail

Current Description

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

Source:  MITRE      Last Modified:  01/04/2018      View Analysis Description

Quick Info

CVE Dictionary Entry:
CVE-2017-5754
Original release date:
01/04/2018
Last revised:
02/10/2018
Source:
US-CERT/NIST

Impact

CVSS Severity (version 3.0):
CVSS v3 Base Score:
5.6 Medium
Vector:
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N (legend)
Impact Score:
4.0
Exploitability Score:
1.1
CVSS Version 3 Metrics:
Attack Vector (AV):
Local
Attack Complexity (AC):
High
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None
CVSS Severity (version 2.0):
CVSS v2 Base Score:
4.7 MEDIUM
Vector:
(AV:L/AC:M/Au:N/C:C/I:N/A:N) (legend)
Impact Subscore:
6.9
Exploitability Subscore:
3.4
CVSS Version 2 Metrics:
Access Vector:
Locally exploitable
Access Complexity:
Medium
Authentication:
Not required to exploit
Impact Type:
Allows unauthorized disclosure of information

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html External Source SUSE SUSE-SU-2018:0010
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html External Source SUSE SUSE-SU-2018:0011
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html External Source SUSE SUSE-SU-2018:0012
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html External Source SUSE openSUSE-SU-2018:0022
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html External Source SUSE openSUSE-SU-2018:0023
http://nvidia.custhelp.com/app/answers/detail/a_id/4609 Third Party Advisory External Source CONFIRM http://nvidia.custhelp.com/app/answers/detail/a_id/4609
http://nvidia.custhelp.com/app/answers/detail/a_id/4611 External Source CONFIRM http://nvidia.custhelp.com/app/answers/detail/a_id/4611
http://nvidia.custhelp.com/app/answers/detail/a_id/4613 External Source CONFIRM http://nvidia.custhelp.com/app/answers/detail/a_id/4613
http://nvidia.custhelp.com/app/answers/detail/a_id/4614 External Source CONFIRM http://nvidia.custhelp.com/app/answers/detail/a_id/4614
http://www.kb.cert.org/vuls/id/584653 Third Party Advisory; US Government Resource External Source CERT-VN VU#584653
http://www.securityfocus.com/bid/102378 External Source BID 102378
http://www.securitytracker.com/id/1040071 Third Party Advisory; VDB Entry External Source SECTRACK 1040071
http://xenbits.xen.org/xsa/advisory-254.html Third Party Advisory External Source CONFIRM http://xenbits.xen.org/xsa/advisory-254.html
https://01.org/security/advisories/intel-oss-10003 Vendor Advisory External Source CONFIRM https://01.org/security/advisories/intel-oss-10003
https://access.redhat.com/errata/RHSA-2018:0292 External Source REDHAT RHSA-2018:0292
https://access.redhat.com/security/vulnerabilities/speculativeexecution Third Party Advisory External Source CONFIRM https://access.redhat.com/security/vulnerabilities/speculativeexecution
https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/ Third Party Advisory External Source CONFIRM https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/
https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ Third Party Advisory External Source CONFIRM https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
https://developer.arm.com/support/security-update Vendor Advisory External Source CONFIRM https://developer.arm.com/support/security-update
https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html Third Party Advisory External Source MISC https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html External Source MLIST [debian-lts-announce] 20180107 [SECURITY] [DLA 1232-1] linux security update
https://meltdownattack.com/ Technical Description; Third Party Advisory External Source MISC https://meltdownattack.com/
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002 Patch; Third Party Advisory; Vendor Advisory External Source CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html Third Party Advisory External Source MISC https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
https://security.netapp.com/advisory/ntap-20180104-0001/ External Source CONFIRM https://security.netapp.com/advisory/ntap-20180104-0001/
https://support.citrix.com/article/CTX231399 External Source CONFIRM https://support.citrix.com/article/CTX231399
https://support.f5.com/csp/article/K91229003 Third Party Advisory External Source CONFIRM https://support.f5.com/csp/article/K91229003
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us External Source CONFIRM https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us
https://support.lenovo.com/us/en/solutions/LEN-18282 Third Party Advisory External Source CONFIRM https://support.lenovo.com/us/en/solutions/LEN-18282
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel External Source CISCO 20180104 CPU Side-Channel Information Disclosure Vulnerabilities
https://usn.ubuntu.com/usn/usn-3516-1/ External Source UBUNTU USN-3516-1
https://usn.ubuntu.com/usn/usn-3522-2/ External Source UBUNTU USN-3522-2
https://usn.ubuntu.com/usn/usn-3523-2/ External Source UBUNTU USN-3523-2
https://usn.ubuntu.com/usn/usn-3524-2/ External Source UBUNTU USN-3524-2
https://usn.ubuntu.com/usn/usn-3525-1/ External Source UBUNTU USN-3525-1
https://www.debian.org/security/2018/dsa-4078 External Source DEBIAN DSA-4078
https://www.debian.org/security/2018/dsa-4082 External Source DEBIAN DSA-4082
https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/ Third Party Advisory External Source CONFIRM https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/
https://www.synology.com/support/security/Synology_SA_18_01 Third Party Advisory External Source CONFIRM https://www.synology.com/support/security/Synology_SA_18_01

Technical Details

Vulnerability Type (View All)

  • Information Leak / Disclosure (CWE-200)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:h:intel:atom_c:c2308:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2316:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2338:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2350:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2358:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2508:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2516:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2518:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2530:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2538:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2550:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2558:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2718:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2730:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2738:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2750:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c2758:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3308:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3338:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3508:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3538:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3558:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3708:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3750:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3758:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3808:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3830:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3850:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3858:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3950:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3955:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_c:c3958:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_e:e3805:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_e:e3815:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_e:e3825:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_e:e3826:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_e:e3827:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_e:e3845:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3130:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3200rk:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3205rk:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3230rk:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3235rk:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3265rk:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3295rk:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3405:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_x3:c3445:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2420:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2460:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2480:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2520:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2560:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2580:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z2760:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3460:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3480:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3530:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3560:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3570:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3580:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3590:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3735d:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3735e:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3735f:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3735g:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3736f:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3736g:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3740:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3740d:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3745:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3745d:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3770:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3770d:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3775:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3775d:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3785:*:*:*:*:*:*:*
cpe:2.3:h:intel:atom_z:z3795:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j1750:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j1800:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j1850:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j1900:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j3060:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j3160:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j3355:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j3455:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j4005:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_j:j4105:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2805:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2806:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2807:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2808:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2810:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2815:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2820:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2830:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2840:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2910:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2920:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2930:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n2940:*:*:*:*:*:*:*
cpe:2.3:h:intel:celeron_n:n3000:*:*:*:*:*:*:*
Configuration 2
Showing 100 of 1059 CPEs, view all CPEs here.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History 8 change records found - show changes