CVE-2022-25368: amperecomputing ampere_altra_firmware
Vulnerability summary
CVE-2022-25368 is a medium (CVSS 4.7) vulnerability in amperecomputing ampere_altra_firmware. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities.
Timeline
- 09-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware context. Speculation caused by these mispredicted branches can then potentially be used to cause cache allocation, which can then be used to infer information that should be protected.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Arm20 products
- cortex-a15_firmwarena
- cortex-a57_firmwarena
- cortex-a65_firmwarena
- cortex-a65ae_firmwarena
- cortex-a710_firmwarena
Amperecomputing2 products
2 vendors · 22 products
References
3 links- amperecomputing.com/products/security-bulletins/impact-of-spectre-bhb-on-ampere.htmlX Refsource MISCVendor Advisory
- cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23960X Refsource CONFIRMThird Party AdvisoryVDB Entry
- developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/spectre-bhbX Refsource MISCPatchTechnical DescriptionVendor Advisory