CVE-2017-5754

MEDIUM

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

CVSS v3.1 Score

5.6
MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector
LOCAL
Complexity
HIGH
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Published: 1/4/2018Modified: 6/17/2026

Related Intelligence (1)

CRITICALAi

58 hardware vulnerabilities: A guide to the threats

In January 2018, the entire computer industry was put on alert by two new processor vulnerabilities dubbed Meltdown and Spectre that defeated the fundamental OS security boundaries separating kernel and user space memory. The flaws stemmed from a performance feature of modern CPUs known as speculative execution and mitigating them required one of the biggest patch coordination efforts in history,

CVE-2017-5753CVE-2017-5715
CSO Online

References (132)

http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609Third Party Advisoryhttp://nvidia.custhelp.com/app/answers/detail/a_id/4611http://nvidia.custhelp.com/app/answers/detail/a_id/4613http://nvidia.custhelp.com/app/answers/detail/a_id/4614http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txthttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txthttp://www.kb.cert.org/vuls/id/584653Third Party AdvisoryUS Government Resourcehttp://www.securityfocus.com/bid/102378http://www.securityfocus.com/bid/106128http://www.securitytracker.com/id/1040071Third Party AdvisoryVDB Entryhttp://xenbits.xen.org/xsa/advisory-254.htmlThird Party Advisoryhttps://access.redhat.com/errata/RHSA-2018:0292https://access.redhat.com/security/vulnerabilities/speculativeexecutionThird Party Advisoryhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/Third Party Advisoryhttps://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/Third Party Advisoryhttps://cdrdv2.intel.com/v1/dl/getContent/685358https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfhttps://cert.vde.com/en-us/advisories/vde-2018-002https://cert.vde.com/en-us/advisories/vde-2018-003https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlThird Party Advisoryhttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixeshttps://lists.debian.org/debian-lts-announce/2018/01/msg00004.htmlhttps://meltdownattack.com/Technical DescriptionThird Party Advisoryhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002PatchThird Party Advisoryhttps://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.aschttps://security.gentoo.org/glsa/201810-06https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlThird Party Advisoryhttps://security.netapp.com/advisory/ntap-20180104-0001/https://source.android.com/security/bulletin/2018-04-01https://support.citrix.com/article/CTX231399https://support.citrix.com/article/CTX234679https://support.f5.com/csp/article/K91229003Third Party Advisoryhttps://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_ushttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_ushttps://support.lenovo.com/us/en/solutions/LEN-18282Third Party Advisoryhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelhttps://usn.ubuntu.com/3522-3/https://usn.ubuntu.com/3522-4/https://usn.ubuntu.com/3523-1/https://usn.ubuntu.com/3540-2/https://usn.ubuntu.com/3541-2/https://usn.ubuntu.com/3583-1/https://usn.ubuntu.com/3597-1/https://usn.ubuntu.com/3597-2/https://usn.ubuntu.com/usn/usn-3516-1/https://usn.ubuntu.com/usn/usn-3522-2/https://usn.ubuntu.com/usn/usn-3523-2/https://usn.ubuntu.com/usn/usn-3524-2/https://usn.ubuntu.com/usn/usn-3525-1/https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinhttps://www.debian.org/security/2018/dsa-4078https://www.debian.org/security/2018/dsa-4082https://www.debian.org/security/2018/dsa-4120https://www.kb.cert.org/vuls/id/180049https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/Third Party Advisoryhttps://www.synology.com/support/security/Synology_SA_18_01Third Party Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609Third Party Advisoryhttp://nvidia.custhelp.com/app/answers/detail/a_id/4611http://nvidia.custhelp.com/app/answers/detail/a_id/4613http://nvidia.custhelp.com/app/answers/detail/a_id/4614http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txthttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txthttp://www.kb.cert.org/vuls/id/584653Third Party AdvisoryUS Government Resourcehttp://www.securityfocus.com/bid/102378http://www.securityfocus.com/bid/106128http://www.securitytracker.com/id/1040071Third Party AdvisoryVDB Entryhttp://xenbits.xen.org/xsa/advisory-254.htmlThird Party Advisoryhttps://access.redhat.com/errata/RHSA-2018:0292https://access.redhat.com/security/vulnerabilities/speculativeexecutionThird Party Advisoryhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/Third Party Advisoryhttps://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/Third Party Advisoryhttps://cdrdv2.intel.com/v1/dl/getContent/685358https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfhttps://cert.vde.com/en-us/advisories/vde-2018-002https://cert.vde.com/en-us/advisories/vde-2018-003https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlThird Party Advisoryhttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixeshttps://lists.debian.org/debian-lts-announce/2018/01/msg00004.htmlhttps://meltdownattack.com/Technical DescriptionThird Party Advisoryhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002PatchThird Party Advisoryhttps://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.aschttps://security.gentoo.org/glsa/201810-06https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlThird Party Advisoryhttps://security.netapp.com/advisory/ntap-20180104-0001/https://source.android.com/security/bulletin/2018-04-01https://support.citrix.com/article/CTX231399https://support.citrix.com/article/CTX234679https://support.f5.com/csp/article/K91229003Third Party Advisoryhttps://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_ushttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_ushttps://support.lenovo.com/us/en/solutions/LEN-18282Third Party Advisoryhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelhttps://usn.ubuntu.com/3522-3/https://usn.ubuntu.com/3522-4/https://usn.ubuntu.com/3523-1/https://usn.ubuntu.com/3540-2/https://usn.ubuntu.com/3541-2/https://usn.ubuntu.com/3583-1/https://usn.ubuntu.com/3597-1/https://usn.ubuntu.com/3597-2/https://usn.ubuntu.com/usn/usn-3516-1/https://usn.ubuntu.com/usn/usn-3522-2/https://usn.ubuntu.com/usn/usn-3523-2/https://usn.ubuntu.com/usn/usn-3524-2/https://usn.ubuntu.com/usn/usn-3525-1/https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinhttps://www.debian.org/security/2018/dsa-4078https://www.debian.org/security/2018/dsa-4082https://www.debian.org/security/2018/dsa-4120https://www.kb.cert.org/vuls/id/180049https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/Third Party Advisoryhttps://www.synology.com/support/security/Synology_SA_18_01Third Party Advisory