CVE-2022-23960Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB.
Updated under an hour ago ()
Does this affect you?
It affects xen and 21 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.
- CVSS
- 5.6 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
xen xen xen:xen | all versions | NVD |
arm cortex-r7_firmware arm:cortex-r7_firmware | all versions | NVD |
arm cortex-r8_firmware arm:cortex-r8_firmware | all versions | NVD |
arm cortex-a57_firmware arm:cortex-a57_firmware | all versions | NVD |
arm cortex-a65_firmware arm:cortex-a65_firmware | all versions | NVD |
arm cortex-a65ae_firmware arm:cortex-a65ae_firmware | all versions | NVD |
arm cortex-a710_firmware arm:cortex-a710_firmware | all versions | NVD |
arm cortex-a72_firmware arm:cortex-a72_firmware | all versions | NVD |
arm cortex-a73_firmware arm:cortex-a73_firmware | all versions | NVD |
arm cortex-a75_firmware arm:cortex-a75_firmware | all versions | NVD |
arm cortex-a76_firmware arm:cortex-a76_firmware | all versions | NVD |
arm cortex-a76ae_firmware arm:cortex-a76ae_firmware | all versions | NVD |
arm cortex-a77_firmware arm:cortex-a77_firmware | all versions | NVD |
arm cortex-a78_firmware arm:cortex-a78_firmware | all versions | NVD |
arm cortex-a78ae_firmware arm:cortex-a78ae_firmware | all versions | NVD |
arm cortex-x1_firmware arm:cortex-x1_firmware | all versions | NVD |
arm cortex-x2_firmware arm:cortex-x2_firmware | all versions | NVD |
arm neoverse-e1_firmware arm:neoverse-e1_firmware | all versions | NVD |
arm neoverse-v1_firmware arm:neoverse-v1_firmware | all versions | NVD |
arm neoverse_n1_firmware arm:neoverse_n1_firmware | all versions | NVD |
arm neoverse_n2_firmware arm:neoverse_n2_firmware | all versions | NVD |
debian debian_linux debian:debian_linux | 9.0; 10.0 | NVD |
References
- https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityx-refsource-confirm
- https://developer.arm.com/support/arm-security-updatesx-refsource-misc
- http://www.openwall.com/lists/oss-security/2022/03/18/2mailing-list, x-refsource-mlist
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.htmlmailing-list, x-refsource-mlist
- https://www.debian.org/security/2022/dsa-5173vendor-advisory, x-refsource-debian
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.