CVE-2017-5754: arm cortex-a
Modified
AliasesALPINE-CVE-2017-5754UBUNTU-CVE-2017-5754USN-3522-1USN-3522-2USN-3524-1DEBIAN-CVE-2017-5754DSA-4078-1
Published 04-01-2018Last modified 28-05-2026
Vulnerability summary
CVE-2017-5754 is a medium (CVSS 5.6) vulnerability in arm cortex-a. EPSS estimates a 67.41% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 5.6, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
5.6/10
010
Medium · v3.1 (CVE.org)EPSS score
67.41%
0%100%
Critical · -16.77 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 63 · Related 35DLA-1232-1DSA-4082-1DSA-4120-1MGASA-2018-0073MGASA-2018-0074MGASA-2018-0075MGASA-2018-0076MGASA-2018-0077MGASA-2018-0078MGASA-2018-0080MGASA-2018-0134MGASA-2018-0172MGASA-2018-0187MGASA-2018-0264OPENSUSE-SU-2024:10728-1OPENSUSE-SU-2024:13704-1RHSA-2018:0010RHSA-2018:0016RHSA-2018:0017RHSA-2018:0018RHSA-2018:0020RHSA-2018:0021RHSA-2018:0022RHSA-2018:0292RHSA-2018:0464RHSA-2018:1062RHSA-2018:1129RHSA-2018:1319RHSA-2018:1346RHSA-2018:1374SUSE-SU-2018:0010-1SUSE-SU-2018:0011-1SUSE-SU-2018:0012-1SUSE-SU-2018:0031-1SUSE-SU-2018:0040-1SUSE-SU-2018:0115-1SUSE-SU-2018:0180-1SUSE-SU-2018:0213-1SUSE-SU-2018:0219-1SUSE-SU-2018:0285-1SUSE-SU-2018:0438-1SUSE-SU-2018:0472-1SUSE-SU-2018:0552-1SUSE-SU-2018:0552-2SUSE-SU-2018:0601-1SUSE-SU-2018:0609-1SUSE-SU-2018:0638-1SUSE-SU-2018:0678-1SUSE-SU-2018:0909-1SUSE-SU-2018:1603-1SUSE-SU-2018:1658-1SUSE-SU-2018:1699-1SUSE-SU-2018:1699-2SUSE-SU-2018:2528-1SUSE-SU-2018:3230-1SUSE-SU-2023:0634-1USN-3516-1USN-3523-2USN-3540-1USN-3540-2USN-3541-2USN-3583-1USN-3597-2
Timeline
- 04-01-2018PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
CVSS metrics
8 scores · 5 sources · 3 versionsMedium 5.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NSourcesAll 3 agree
- NVDNIST5.6MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Medium 5.6Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated5.6MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.6MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.6MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Medium 4.7Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:C/I:N/A:NSourcesSingle source
EPSS trend
Probability
67.41%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
Decrease -16.77 pp
From 84.17% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Intel174 products
- atom_cc2308 | c2316 | c2338 | c2350 | c2358 | c2508 | c2516 | c2518 | c2530 | c2538 | c2550 | c2558 | c2718 | c2730 | c2738 | c2750 | c2758 | c3308 | c3338 | c3508 | c3538 | c3558 | c3708 | c3750 | c3758 | c3808 | c3830 | c3850 | c3858 | c3950 | c3955 | c3958
- atom_ee3805 | e3815 | e3825 | e3826 | e3827 | e3845
- atom_x3c3130 | c3200rk | c3205rk | c3230rk | c3235rk | c3265rk | c3295rk | c3405 | c3445
- atom_zz2420 | z2460 | z2480 | z2520 | z2560 | z2580 | z2760 | z3460 | z3480 | z3530 | z3560 | z3570 | z3580 | z3590 | z3735d | z3735e | z3735f | z3735g | z3736f | z3736g | z3740 | z3740d | z3745 | z3745d | z3770 | z3770d | z3775 | z3775d | z3785 | z3795
- celeron_jj1750 | j1800 | j1850 | j1900 | j3060 | j3160 | j3355 | j3455 | j4005 | j4105
Ubuntu19 products
- firefox< 57.0.4+build1-0ubuntu0.14.04.1 | < 57.0.4+build1-0ubuntu0.16.04.1 | < 59.0.1+build1-0ubuntu1
- linux< 4.4.0-108.131 | < 3.13.0-139.188
- linux-aws< 4.4.0-1047.56 | < 4.4.0-1009.9
- linux-azure< 4.13.0-1005.7
- linux-azure-fdeAll versions (No fix recorded)
Debian3 products
- linux< 4.14.12-1 | < 4.9.65-3+deb9u2
- nvidia-graphics-drivers< 384.111-1
- xen< 4.11.1~pre+1.733450b39b-1
Alpine2 products
- intel-ucode< 20190514a-r0
- xen< 4.7.3-r4 | < 4.8.2-r4
Arm1 product
- cortex-a75
Intel corporation1 product
6 vendors · 200 products · Showing 200 of 234
References
92 links
- support.citrix.com/article/CTX234679X Refsource CONFIRM
- access.redhat.com/security/vulnerabilities/speculativeexecutionX Refsource CONFIRMThird Party Advisory
Show all 92 references
portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002X Refsource CONFIRMPatchThird Party AdvisoryVendor Advisory- nvidia.custhelp.com/app/answers/detail/a_id/4611X Refsource CONFIRM
- security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlX Refsource MISCThird Party AdvisoryREPORT
- cert.vde.com/en-us/advisories/vde-2018-002X Refsource CONFIRM
- source.android.com/security/bulletin/2018-04-01X Refsource CONFIRM
- security.netapp.com/advisory/ntap-20180104-0001/X Refsource CONFIRM
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txtX Refsource CONFIRM
- help.ecostruxureit.com/display/…X Refsource CONFIRM
- cert.vde.com/en-us/advisories/vde-2018-003X Refsource CONFIRM
- help.ecostruxureit.com/display/…X Refsource CONFIRM
- support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_usX Refsource CONFIRM
- www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/X Refsource CONFIRMThird Party Advisory
- support.citrix.com/article/CTX231399X Refsource CONFIRM
- security.freebsd.org/advisories/FreeBSD-SA-18:03.speculative_execution.ascVendor AdvisoryX Refsource FREEBSD
- blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/X Refsource CONFIRMThird Party Advisory
- nvidia.custhelp.com/app/answers/detail/a_id/4614X Refsource CONFIRM
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelVendor AdvisoryX Refsource CISCO
- googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlX Refsource MISCThird Party Advisory
- nvidia.custhelp.com/app/answers/detail/a_id/4613X Refsource CONFIRM
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txtX Refsource CONFIRM
- cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfX Refsource CONFIRM
- www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC
- cdrdv2.intel.com/v1/dl/getContent/685358X Refsource CONFIRM
- github.com/IAIK/KAISERREPORT