What’s Vulnerable › Vulnerabilities

CVE-2022-48251

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-10 · updated 2026-06-17
• Weakness: CWE-203

Description

The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."

Affected products

• Arm Cortex-A53 Firmware: all versions
• Arm Cortex-A55 Firmware: all versions
• Arm Cortex-A57 Firmware: all versions
• Arm Cortex-A72 Firmware: all versions
• Arm Cortex-A73 Firmware: all versions
• Arm Cortex-A75 Firmware: all versions
• Arm Cortex-A76 Firmware: all versions
• Arm Cortex-A76Ae Firmware: all versions
• Arm Cortex-A77 Firmware: all versions
• Arm Cortex-A78 Firmware: all versions

References

• https://eprint.iacr.org/2022/230
• https://eshard.com/posts/sca-attacks-on-armv8
• https://eprint.iacr.org/2022/230
• https://eshard.com/posts/sca-attacks-on-armv8

Get alerted when CVE-2022-48251 or the next vulnerability affects your stack