CVE-2022-23960 Information disclosure in n/a
Attackers can exploit Spectre-BHB in Arm processors to leak sensitive information via branch history buffer speculation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23960?
CVE-2022-23960 is a medium-severity vulnerability in Debian Debian Linux, published on 12 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.
Which versions are affected by CVE-2022-23960?
It affects 22 products.
Products include Arm Cortex-A57 Firmware, Arm Cortex-A65 Firmware, Arm Cortex-A65ae Firmware, Arm Cortex-A710 Firmware, Arm Cortex-A72 Firmware, Arm Cortex-A73 Firmware and 16 more.
How do I fix CVE-2022-23960?
Apply the vendor's patch.
Is CVE-2022-23960 being exploited?
There is no known exploitation of CVE-2022-23960 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as A-215557547, ALPINE-CVE-2022-23960, ASB-A-215557547, DEBIAN-CVE-2022-23960, GHSA-m7j2-567h-fvrw, UBUNTU-CVE-2022-23960 and 1 more.