Vulnerability Details : CVE-2022-25368
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware context. Speculation caused by these mispredicted branches can then potentially be used to cause cache allocation, which can then be used to infer information that should be protected.
Products affected by CVE-2022-25368
- cpe:2.3:o:arm:cortex-a57_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a72_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a73_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a15_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a75_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a76_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a77_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a78_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a78ae_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:neoverse_n1_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:neoverse_n2_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-x1_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:neoverse-e1_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:neoverse-v1_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a65_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a65ae_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a76ae_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a78c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-x2_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:arm:cortex-a710_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amperecomputing:ampere_altra_max_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amperecomputing:ampere_altra_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-25368
0.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-25368
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
1.9
|
LOW | AV:L/AC:M/Au:N/C:P/I:N/A:N |
3.4
|
2.9
|
NIST | |
|
4.7
|
MEDIUM | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.0
|
3.6
|
NIST |
References for CVE-2022-25368
-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23960
CVE - CVE-2022-23960Third Party Advisory;VDB Entry
-
https://amperecomputing.com/products/security-bulletins/impact-of-spectre-bhb-on-ampere.html
Impact of Spectre BHB on AmpereVendor Advisory
-
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/spectre-bhb
Speculative Processor Vulnerability | Spectre-BHB – Arm DeveloperPatch;Technical Description;Vendor Advisory
Jump to