CVE-2022-37459

Опубликовано: 17 авг. 2022

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hijack code flow to execute arbitrary code via a side-channel attack, aka a "Retbleed" issue.

Ссылки

https://amperecomputing.com/products/security-bulletins/retbleed.html
Vendor Advisory
https://developer.arm.com/documentation/ka005138/1-0/
Third Party Advisory
https://amperecomputing.com/products/security-bulletins/retbleed.html
Vendor Advisory
https://developer.arm.com/documentation/ka005138/1-0/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:amperecomputing:ampere_altra_firmware:*:*:*:*:*:*:*:*

Версия до 1.08g (исключая)

cpe:2.3:h:amperecomputing:ampere_altra:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:amperecomputing:ampere_altra_max_firmware:*:*:*:*:*:*:*:*

Версия до 2.05a (исключая)

cpe:2.3:h:amperecomputing:ampere_altra_max:-:*:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00165

Низкий

7.8 High

CVSS3

Дефекты

CWE-203

Связанные уязвимости

GHSA-gp65-59gv-vqpf