CVE-2017-5754
Quick assessment
Affected
Intel Corporation Most Modern Operating Systems
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ARM Cortex-R7等都是英国ARM公司的产品。ARM Cortex-R7是一款中央处理器（CPU）。Cortex-R8是一款中央处理器（CPU）。Intel Xeon CPU E5-1650等都是美国英特尔（Intel）公司的产品。Xeon CPU E5-1650是一款中央处理器（CPU）。 Intel和ARM CPU芯片存在信息泄露漏洞，该漏洞源于处理器数据边界机制中存在缺陷。本地攻击者可通过滥用‘错误推测执行’利用该漏洞读取读取内存信息。以下产品和版本受到影响：ARM Cortex-A75；I
Possible ATT&CK Techniques 1 AI
T1056.001 · KeyloggingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Intel Corporation | Most Modern Operating Systems | All |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-5754
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Intel和ARM CPU芯片信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ARM Cortex-R7等都是英国ARM公司的产品。ARM Cortex-R7是一款中央处理器（CPU）。Cortex-R8是一款中央处理器（CPU）。Intel Xeon CPU E5-1650等都是美国英特尔（Intel）公司的产品。Xeon CPU E5-1650是一款中央处理器（CPU）。 Intel和ARM CPU芯片存在信息泄露漏洞，该漏洞源于处理器数据边界机制中存在缺陷。本地攻击者可通过滥用‘错误推测执行’利用该漏洞读取读取内存信息。以下产品和版本受到影响：ARM Cortex-A75；I
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Intel Corporation | Most Modern Operating Systems | All | - |
|
II. Public POCs for CVE-2017-5754
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | SpecuCheck is a Windows utility for checking the state of the software mitigations and hardware against CVE-2017-5754 (Meltdown), CVE-2017-5715 (Spectre v2), CVE-2018-3260 (Foreshadow), and CVE-2018-3639 (Spectre v4) | https://github.com/ionescu007/SpecuCheck | POC Details |
| 2 | Meltdown Exploit / Proof-of-concept / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a MELTDOWN. | https://github.com/raphaelsc/Am-I-affected-by-Meltdown | POC Details |
| 3 | This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2017-5754 (Meltdown) and CVE-2017-5715 (Spectre) allows unprivileged processes to steal secrets from privileged processes. These attacks present 3 different ways of attacking data protection measures on CPUs enabling attackers to read data they shouldn't be able to. This tool is originally based on Microsoft: https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in | https://github.com/Viralmaniar/In-Spectre-Meltdown | POC Details |
| 4 | Proof-of-concept / Exploit / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a | https://github.com/speecyy/Am-I-affected-by-Meltdown | POC Details |
| 5 | PoC for Meltdown in linux (CVE-2017-5754) | https://github.com/zzado/Meltdown | POC Details |
| 6 | Naive shell script to verify Meltdown (CVE-2017-5754) patch status of EC2 instances | https://github.com/jdmulloy/meltdown-aws-scanner | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-5754
请登录查看更多情报信息。
Vendor Advisories for CVE-2017-5754 (34)
-
🔗 https://security.netapp.com/advisory/ntap-20180104-0001/ x_refsource_CONFIRM
-
https://support.lenovo.com/us/en/solutions/LEN-18282 x_refsource_CONFIRM
-
🔗 https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/ x_refsource_CONFIRM
-
🔗 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002 x_refsource_CONFIRM
-
-
🔗 https://www.oracle.com/security-alerts/cpuapr2020.html x_refsource_MISC
-
🔗 https://access.redhat.com/security/vulnerabilities/speculativeexecution x_refsource_CONFIRM
-
🔗 https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf x_refsource_CONFIRM
-
🔗 https://support.f5.com/csp/article/K91229003 x_refsource_CONFIRM
-
-
🔗 https://source.android.com/security/bulletin/2018-04-01 x_refsource_CONFIRM
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
🔗 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel vendor-advisory x_refsource_CISCO
Mailing List Discussions for CVE-2017-5754 (6)
-
🔗 http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html vendor-advisory x_refsource_SUSE
-
🔗 http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html vendor-advisory x_refsource_SUSE
-
🔗 http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html vendor-advisory x_refsource_SUSE
-
Security Blog Posts for CVE-2017-5754 (1)
Other References for CVE-2017-5754 (23)
-
🔗 https://support.citrix.com/article/CTX234679 x_refsource_CONFIRM
-
-
🔗 https://cert.vde.com/en-us/advisories/vde-2018-002 x_refsource_CONFIRM
-
🔗 http://nvidia.custhelp.com/app/answers/detail/a_id/4614 x_refsource_CONFIRM
-
🔗 https://support.citrix.com/article/CTX231399 x_refsource_CONFIRM
-
🔗 https://www.synology.com/support/security/Synology_SA_18_01 x_refsource_CONFIRM
-
🔗 http://nvidia.custhelp.com/app/answers/detail/a_id/4611 x_refsource_CONFIRM
-
🔗 http://xenbits.xen.org/xsa/advisory-254.html x_refsource_CONFIRM
-
-
🔗 https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/ x_refsource_CONFIRM
-
-
-
-
🔗 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us x_refsource_CONFIRM
-
-
🔗 https://cdrdv2.intel.com/v1/dl/getContent/685358 x_refsource_CONFIRM
-
http://nvidia.custhelp.com/app/answers/detail/a_id/4613 x_refsource_CONFIRM
-
🔗 http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt x_refsource_CONFIRM
-
🔗 https://cert.vde.com/en-us/advisories/vde-2018-003 x_refsource_CONFIRM
-
🔗 http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt x_refsource_CONFIRM
-
🔗 https://meltdownattack.com/ x_refsource_MISC
-
http://nvidia.custhelp.com/app/answers/detail/a_id/4609 x_refsource_CONFIRM
-
🔗 https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.asc vendor-advisory x_refsource_FREEBSD
Same Patch Batch · Intel Corporation · 2018-01-04 · 3 CVEs total
| CVE-2017-5715 | Intel和ARM CPU芯片信息泄露漏洞 | |
| CVE-2017-5753 | Intel和ARM CPU芯片信息泄露漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2017-5754
No comments yet