CVE-2024-5660: arm cortex-78c Exposure of Resource to Wrong Sphere
Vulnerability summary
CVE-2024-5660 is a critical (CVSS 9.8) Exposure of Resource to Wrong Sphere vulnerability in arm cortex-78c. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 10-12-2024PublishedVulnerability first disclosed.
- 16-12-2024Last modifiedVulnerability information updated.
Description
Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Arm21 products
- cortex-78cAll versions (No fix recorded)
- cortex-a710_firmwareAll versions (No fix recorded) | na
- cortex-a77_firmwareAll versions (No fix recorded) | na
- cortex-a78_firmwareAll versions (No fix recorded) | na
- cortex-a78ae_firmwareAll versions (No fix recorded) | na
Alpine1 product
- arm-trusted-firmware< 2.8.32-r0
Debian1 product
- arm-trusted-firmwareAll versions (No fix recorded) | < 2.12.1+dfsg-1
Ubuntu1 product
- arm-trusted-firmwareAll versions (No fix recorded)
4 vendors · 24 products
References
5 links- developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660REPORTVendor Advisory
