NVD Vulnerability Detail

CVE-2020-13844

Summary	Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation."
Publication Date	June 9, 2020, 8:15 a.m.
Registration Date	Jan. 26, 2021, 11:52 a.m.
Last Update	Nov. 21, 2024, 2:01 p.m.

CVSS3.1 : MEDIUM
スコア	5.5
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : LOW
Score	2.1
Vector	AV:L/AC:L/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a32_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a32:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a35_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a35:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a53_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a53:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a57_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a57:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a72_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a72:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a73_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a73:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:arm:cortex-a34_firmware:-:::::::*
execution environment
1	cpe:2.3:h:arm:cortex-a34:-:::::::*

Configuration8	or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.1:::::::*
cpe:2.3:o:opensuse:leap:15.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00039.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00040.html	Mailing List Third Party Advisory
4	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability	Vendor Advisory
5	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation	Vendor Advisory
6	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions	Vendor Advisory
7	https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547520.html	Patch Third Party Advisory
8	http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html	Mailing List Third Party Advisory
9	https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547520.html	Patch Third Party Advisory
10	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions	Vendor Advisory
11	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation	Vendor Advisory
12	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability	Vendor Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00040.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00039.html	Mailing List Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-203	セキュリティ関連の処理に対するレスポンスの違いに起因する情報漏えい	https://cwe.mitre.org/data/definitions/203.html

JVN Vulnerability Information

Arm Armv8-A における情報漏えいの脆弱性

Title	Arm Armv8-A における情報漏えいの脆弱性
Summary	Arm Armv8-A には、情報漏えいの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 8, 2020, midnight
Registration Date	July 3, 2020, 6:03 p.m.
Last Update	July 3, 2020, 6:03 p.m.

Affected System

ARM Ltd.

Cortex-A32 ファームウェア

Cortex-A34 ファームウェア

Cortex-A35 ファームウェア

Cortex-A53 ファームウェア

Cortex-A57 ファームウェア

Cortex-A72 ファームウェア

Cortex-A73 ファームウェア

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-13844	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13844
National Vulnerability Database (NVD)
2	CVE-2020-13844	https://nvd.nist.gov/vuln/detail/CVE-2020-13844

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Arm Developer
1	Frequently asked questions	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions
2	Straight-line Speculation	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation
3	Vulnerability of Speculative Processors to Cache Timing Side-Channel Mechanism	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability

その他

No	Name	URL
関連文書
1	Straight Line Speculation (SLS) mitigation.	https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547520.html

Change Log

No	Changed Details	Date of change
1	[2020年07月03日] 掲載	July 3, 2020, 6:03 p.m.