← Vulnerability feed

Vulnerability record · CVE-2022-23960 · published 13 March 2022

CVE-2022-23960: Xen vulnerability

Xen · Xen

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.

5.6 CVSS 3.1 Medium EPSS 0.50% · top 59.7%
5.6CVSS 3.1 base score, v2 1.9
0.50%EPSS exploitation probability, 30 days
NoNot in CISA KEV
22Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

22 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2022/03/18/2 Mailing ListPatchThird Party Advisory
https://developer.arm.com/support/arm-security-updates Vendor Advisory
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability MitigationPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html Mailing ListThird Party Advisory
https://www.debian.org/security/2022/dsa-5173 Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/18/2 Mailing ListPatchThird Party Advisory
https://developer.arm.com/support/arm-security-updates Vendor Advisory
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability MitigationPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html Mailing ListThird Party Advisory
https://www.debian.org/security/2022/dsa-5173 Third Party Advisory

Track CVE-2022-23960 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-5660Arm cortex-a710 firmware exposure of resource to wrong sphere vulnerabilityUse of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cort…EPSS 0.56%7.9CVE-2025-0647Arm c1-ultra firmware vulnerabilityIn certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, eit…EPSS 0.17%7.5CVE-2022-48251Arm cortex-a53 firmware observable discrepancy vulnerabilityThe AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor repor…EPSS 0.83%5.5CVE-2020-13844Arm cortex-a32 firmware observable discrepancy vulnerabilityArm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of info…EPSS 0.49%5.1CVE-2024-10929Arm cortex-a57 firmware observable discrepancy vulnerabilityIn certain circumstances, an issue in Arm Cortex-A57, Cortex-A72 (revisions before r1p0), Cortex-A73 and Cortex-A75 may allow an adversary to gain a …EPSS 0.17%4.7CVE-2022-25368Amperecomputing ampere altra max firmware vulnerabilitySpectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branc…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2022-23960), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.