CVE-2017-5754
MediumSystems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Published Jan 4, 2018 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2017-5754, DEBIAN-CVE-2017-5754, DSA-4078-1, Meltdown, Rogue Data Cache Load, SUSE-SU-2018:3230-1, SUSE-SU-2023:0634-1, UBUNTU-CVE-2017-5754, USN-3522-1, USN-3522-2, USN-3524-1
Key Facts
Patch immediately- CVE-2017-5754 is a medium-severity vulnerability (CVSS 5.6 v3.1) affecting Cortex-A (Arm), Atom C (Intel), Atom E (Intel) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 84% probability of exploitation in the next 30 days.
- Fixed versions are available, including clang NA, clang-devel NA, cluster-md-kmp-default 4.12.14-122.150.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
84%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2017-5754 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Affected Products
2,003 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Cortex-AArm | 75 | n/a |
| Atom CIntel | c2308, c2316, c2338, c2350, c2358, c2508, c2516, c2518 | n/a |
| Atom EIntel | e3805, e3815, e3825, e3826, e3827, e3845 | n/a |
| Atom X3Intel | c3130, c3200rk, c3205rk, c3230rk, c3235rk, c3265rk, c3295rk, c3405 | n/a |
| Atom ZIntel | z2420, z2460, z2480, z2520, z2560, z2580, z2760, z3460 | n/a |
Patched Releases
clang
NA
clang-devel
NA
cluster-md-kmp-default
4.12.14-122.150.1, 4.4.103-6.38.1, 4.4.103-92.56.1
cluster-md-kmp-rt
4.4.104-24.1
cluster-network-kmp-default
4.4.103-92.56.1
cluster-network-kmp-rt
4.4.104-24.1
dlm-kmp-default
4.12.14-122.150.1, 4.4.103-6.38.1, 4.4.103-92.56.1
dlm-kmp-rt
4.4.104-24.1
dtrace-modules-3.8.13-118.20.2.el6uek
0.4.5-3.el6
dtrace-modules-3.8.13-118.20.2.el7uek
0.4.5-3.el7
firefox
57.0.4+build1-0ubuntu0.14.04.1, 57.0.4+build1-0ubuntu0.16.04.1, 59.0.1+build1-0ubuntu1
gfs2-kmp-default
4.12.14-122.150.1, 4.4.103-6.38.1, 4.4.103-92.56.1
gfs2-kmp-rt
4.4.104-24.1
intel-ucode
20190514a-r0
ivshmem-tools
15:3.0.0-1.el7, 15:3.1.0-1.el7
kernel
0:2.6.18-426.el5, 0:2.6.32-431.85.2.el6, 0:3.10.0-862.el7, 2.6.18-419.0.0.0.8.el5, 2.6.32-696.18.7.el6, 3.10.0-693.11.6.el7, 4.9.76-3.78.amzn1, 4.9.76-38.79.amzn2
kernel-abi-whitelists
2.6.32-696.18.7.el6, 3.10.0-693.11.6.el7
kernel-alt
0:4.14.0-49.2.2.el7a
kernel-bigmem
3.0.101-108.21.1
kernel-bigmem-base
3.0.101-108.21.1
kernel-bigmem-devel
3.0.101-108.21.1
kernel-bigsmp
3.0.101-0.47.106.11.1
kernel-bigsmp-base
3.0.101-0.47.106.11.1
kernel-bigsmp-devel
3.0.101-0.47.106.11.1
kernel-debug
2.6.18-419.0.0.0.8.el5, 2.6.32-696.18.7.el6, 3.10.0-693.11.6.el7, 4.4.104-18.44.1, 4.4.104-39.1
Timeline
Publicly disclosed
Jan 4, 2018
Last updated
Aug 4, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-208 Observable Timing Discrepancy
- CWE-226 Sensitive Information in Resource Not Removed Before Reuse
- CWE-385 Covert Timing Channel
References
- advisoryhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609
- advisoryRHSA-2018:0010
- advisoryRHSA-2018:0016
- advisoryRHSA-2018:0017
- advisoryRHSA-2018:0018
FAQ
Common Questions.
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Affected: Cortex-A (Arm) versions 75; Atom C (Intel) versions c2308, c2316, c2338, c2350, c2358, c2508, c2516, c2518; Atom E (Intel) versions e3805, e3815, e3825, e3826, e3827, e3845, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including clang NA, clang-devel NA, cluster-md-kmp-default 4.12.14-122.150.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-5754 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo