7.5

CVE-2022-48251

Exploit

The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Arm ≫ Cortex-a53 Firmware Version-
   Arm ≫ Cortex-a53 Version-
Arm ≫ Cortex-a55 Firmware Version-
   Arm ≫ Cortex-a55 Version-
Arm ≫ Cortex-a57 Firmware Version-
   Arm ≫ Cortex-a57 Version-
Arm ≫ Cortex-a72 Firmware Version-
   Arm ≫ Cortex-a72 Version-
Arm ≫ Cortex-a73 Firmware Version-
   Arm ≫ Cortex-a73 Version-
Arm ≫ Cortex-a75 Firmware Version-
   Arm ≫ Cortex-a75 Version-
Arm ≫ Cortex-a76 Firmware Version-
   Arm ≫ Cortex-a76 Version-
Arm ≫ Cortex-a76ae Firmware Version-
   Arm ≫ Cortex-a76ae Version-
Arm ≫ Cortex-a77 Firmware Version-
   Arm ≫ Cortex-a77 Version-
Arm ≫ Cortex-a78 Firmware Version-
   Arm ≫ Cortex-a78 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.353
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

https://eprint.iacr.org/2022/230
Third Party Advisory
Technical Description
https://eshard.com/posts/sca-attacks-on-armv8
Third Party Advisory
Exploit