CVE-2017-5715: arm cortex-a Observable Discrepancy

Modified

AliasesALPINE-CVE-2017-5715MGASA-2018-0079MGASA-2018-0124+45 more

Published 04-01-2018Last modified 06-05-2025

Vulnerability summary

CVE-2017-5715 is a medium (CVSS 5.6) Observable Discrepancy vulnerability in arm cortex-a. EPSS estimates a 73.25% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 5.6, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.6/10

010

Medium · v3.1 (CVE.org)

EPSS score

73.25%

0%100%

Critical · -0.79 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 146 · Related 111

DLA-1369-1 DLA-1422-1 DLA-1497-1 DSA-4187-1 DSA-4188-1 DSA-4201-1+94 more

Showing 100 of 147.

Timeline

04-01-2018
PublishedVulnerability first disclosed.
06-05-2025
Last modifiedVulnerability information updated.

Description

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVSS metrics

8 scores · 6 sources · 3 versions

v3.15.6v3.05.6v2.01.9

EPSS trend

Probability

73.25%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Decrease -0.79 pp

From 74.04% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselocalmultipleUnverified
Multiple CPUs - 'Spectre' Information Disclosure
Maturity: poc

Weaknesses

CWE · root cause

CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Intel164 products

atom_cc2308 | c2316 | c2338 | c2350 | c2358 | c2508 | c2516 | c2518 | c2530 | c2538 | c2550 | c2558 | c2718 | c2730 | c2738 | c2750 | c2758 | c3308 | c3338 | c3508 | c3538 | c3558 | c3708 | c3750 | c3758 | c3808 | c3830 | c3850 | c3858 | c3950 | c3955 | c3958
atom_ee3805 | e3815 | e3825 | e3826 | e3827 | e3845
atom_x3c3130 | c3200rk | c3205rk | c3230rk | c3235rk | c3265rk | c3295rk | c3405 | c3445
atom_x5-e3930_firmwarena
atom_x5-e3940_firmwarena

Show all 164

Ubuntu24 products

amd64-microcode< 3.20180524.1~ubuntu0.14.04.1 | < 3.20180524.1~ubuntu0.16.04.1 | < 3.20180524.1~ubuntu0.18.04.1
firefox< 57.0.4+build1-0ubuntu0.14.04.1 | < 57.0.4+build1-0ubuntu0.16.04.1 | < 59.0.1+build1-0ubuntu1
intel-microcode< 3.20180108.0~ubuntu14.04.2 | < 3.20180108.0~ubuntu16.04.2 | < 3.20180312.0~ubuntu14.04.1 | < 3.20180312.0~ubuntu16.04.1
libvirt< 1.2.2-0ubuntu13.1.25 | < 1.3.1-1ubuntu10.17
linux< 3.13.0-141.190 | < 4.4.0-112.135 | < 3.13.0-143.192

Show all 24

Debian8 products

amd64-microcode< 3.20180515.1 | < 3.20181128.1~deb9u1 | < 3.20181128.1~deb8u1
arm-trusted-firmwareAll versions (No fix recorded) | < 2.12.16+dfsg-1
intel-microcode< 3.20180425.1
linux< 4.15.11-1
nvidia-graphics-drivers< 384.111-1

Show all 8

Alpine1 product

xen< 4.7.3-r4 | < 4.8.2-r4

Arm1 product

cortex-a9 | 15 | 17 | 57 | 72 | 73 | 75

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 17.04 | 17.10 | 18.04

Intel corporation1 product

microprocessors with speculative executionAll

7 vendors · 200 products · Showing 200 of 441

References

371 links

nvidia.custhelp.com/app/answers/detail/a_id/4609X Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3560-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.debian.org/debian-lts-announce/2018/07/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory
www.debian.org/security/2018/dsa-4187Vendor AdvisoryX Refsource DEBIANThird Party Advisory
usn.ubuntu.com/3542-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
security.gentoo.org/glsa/201810-06Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlX Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlX Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3540-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
access.redhat.com/security/vulnerabilities/speculativeexecutionX Refsource CONFIRMThird Party AdvisoryARTICLE

Show all 100 references

portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002X Refsource CONFIRMPatchThird Party AdvisoryVendor Advisory
lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory
usn.ubuntu.com/3597-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.debian.org/debian-lts-announce/2018/07/msg00016.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlVendor AdvisoryX Refsource SUSEBroken Link
lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlVendor AdvisoryX Refsource SUSEBroken Link
nvidia.custhelp.com/app/answers/detail/a_id/4611X Refsource CONFIRMThird Party Advisory
security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlX Refsource MISCThird Party AdvisoryWEBREPORT
www.debian.org/security/2018/dsa-4213Vendor AdvisoryX Refsource DEBIANThird Party Advisory
cert.vde.com/en-us/advisories/vde-2018-002X Refsource CONFIRMThird Party Advisory
www.debian.org/security/2018/dsa-4120Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00009.htmlVendor AdvisoryX Refsource SUSEBroken Link
usn.ubuntu.com/3580-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
support.f5.com/csp/article/K91229003X Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3531-3/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3620-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlVendor AdvisoryX Refsource SUSEBroken Link
usn.ubuntu.com/3582-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.debian.org/security/2018/dsa-4188Vendor AdvisoryX Refsource DEBIANThird Party Advisory
access.redhat.com/errata/RHSA-2018:0292Vendor AdvisoryX Refsource REDHATThird Party Advisory
xenbits.xen.org/xsa/advisory-254.htmlX Refsource CONFIRMThird Party Advisory
security.netapp.com/advisory/ntap-20180104-0001/X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00012.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.synology.com/support/security/Synology_SA_18_01X Refsource CONFIRMThird Party Advisory
packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txtX Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/102376VDB EntryX Refsource BIDThird Party Advisory
developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityX Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3594-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.kb.cert.org/vuls/id/584653Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.kb.cert.org/vuls/id/180049Third Party AdvisoryX Refsource CERT VNUS Government Resource
cert.vde.com/en-us/advisories/vde-2018-003X Refsource CONFIRMThird Party Advisory
help.ecostruxureit.com/display/…X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00005.htmlVendor AdvisoryX Refsource SUSEBroken Link
usn.ubuntu.com/3690-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_usX Refsource CONFIRMThird Party Advisory
www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001X Refsource CONFIRMThird Party Advisory
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_usX Refsource CONFIRMThird Party Advisory
www.vmware.com/us/security/advisories/VMSA-2018-0004.htmlX Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3549-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00003.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/X Refsource CONFIRMThird Party Advisory
support.citrix.com/article/CTX231399X Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMThird Party Advisory
spectreattack.comX Refsource MISCThird Party AdvisoryARTICLEREPORT
usn.ubuntu.com/3531-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
security.freebsd.org/advisories/FreeBSD-SA-18:03.speculative_execution.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
aws.amazon.com/de/security/security-bulletins/AWS-2018-013/X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00002.htmlVendor AdvisoryX Refsource SUSEBroken Link
usn.ubuntu.com/3581-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/X Refsource CONFIRMThird Party Advisory
www.securitytracker.com/id/1040071VDB EntryX Refsource SECTRACKThird Party Advisory
lists.debian.org/debian-lts-announce/2018/09/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-frX Refsource CONFIRMVendor AdvisoryAdvisoryREPORT
usn.ubuntu.com/3597-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3581-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
nvidia.custhelp.com/app/answers/detail/a_id/4614X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlVendor AdvisoryX Refsource SUSEBroken Link
lists.debian.org/debian-lts-announce/2018/05/msg00000.htmlMailing ListX Refsource MLISTThird Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelVendor AdvisoryX Refsource CISCOThird Party Advisory
usn.ubuntu.com/usn/usn-3516-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.vmware.com/us/security/advisories/VMSA-2018-0002.htmlX Refsource CONFIRMThird Party Advisory
www.exploit-db.com/exploits/43427/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
lists.opensuse.org/opensuse-security-announce/2018-01/msg00013.htmlVendor AdvisoryX Refsource SUSEBroken Link
usn.ubuntu.com/3541-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlX Refsource MISCThird Party AdvisoryARTICLE
support.lenovo.com/us/en/solutions/LEN-18282X Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3777-3/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.vmware.com/security/advisories/VMSA-2018-0007.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2018-01/msg00004.htmlVendor AdvisoryX Refsource SUSEBroken Link
nvidia.custhelp.com/app/answers/detail/a_id/4613X Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3561-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3582-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
seclists.org/bugtraq/2019/Jun/36Mailing ListX Refsource BUGTRAQIssue TrackingThird Party Advisory
www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txtX Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfX Refsource CONFIRMThird Party Advisory
security.freebsd.org/advisories/FreeBSD-SA-19:26.mcu.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
seclists.org/bugtraq/2019/Nov/16Mailing ListX Refsource BUGTRAQIssue TrackingThird Party Advisory
packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.htmlX Refsource MISCThird Party AdvisoryVDB Entry
security.paloaltonetworks.com/CVE-2017-5715X Refsource CONFIRMThird Party Advisory
lists.debian.org/debian-lts-announce/2020/03/msg00025.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.debian.org/debian-lts-announce/2021/08/msg00019.htmlMailing ListX Refsource MLIST
security.alpinelinux.org/vuln/CVE-2017-5715Advisory
advisories.mageia.org/MGASA-2018-0079.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=22337REPORT
downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File?product=52214WEB
www.amd.com/en/corporate/speculative-executionWEBREPORT
meltdownattack.comWEB

Showing 100 of 371.