What’s Vulnerable › Vulnerabilities

CVE-2017-5925

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-02-27 · updated 2026-06-17
• Weakness: CWE-200

Description

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.

Affected products

• Allwinner A64: all versions
• AMD Athlon Ii 640 X4: all versions
• AMD E-350: all versions
• AMD Fx-8120 8-Core: all versions
• AMD Fx-8320 8-Core: all versions
• AMD Fx-8350 8-Core: all versions
• AMD Phenom 9550 4-Core: all versions
• Intel Atom C2750: all versions
• Intel Celeron N2840: all versions
• Intel Core I5 M480: all versions
• Intel Core I7-2620Qm: all versions
• Intel Core I7-3632Qm: all versions
• Intel Core I7-4500U: all versions
• Intel Core I7-6700K: all versions
• Intel Core I7 920: all versions
• Intel Xeon E3-1240 V5: all versions
• Intel Xeon E5-2658 V2: all versions
• NVIDIA Tegra K1 Cd570M-A1: all versions
• NVIDIA Tegra K1 Cd580M-A1: all versions
• Samsung Exynos 5800: all versions

References

• http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
• http://www.securityfocus.com/bid/96452
• https://www.vusec.net/projects/anc
• http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
• http://www.securityfocus.com/bid/96452
• https://www.vusec.net/projects/anc

Get alerted when CVE-2017-5925 or the next vulnerability affects your stack