CVE-2017-5754

Description

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

How to fix CVE-2017-5754

To remediate CVE-2017-5754, upgrade the affected package to a fixed version below.

• Alpine/intel-ucode—upgrade to 20190514a-r0 or later
• —upgrade to 4.7.3-r4 or later
• —upgrade to 4.14.12-1 or later
• —upgrade to 4.9.65-3+deb9u2 or later
• —upgrade to 384.111-1 or later
• —upgrade to 4.11.1~pre+1.733450b39b-1 or later

Is CVE-2017-5754 being exploited?

Likely — EPSS is 89.6%, placing CVE-2017-5754 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (6)

• from 0, < 20190514a-r0
• from 0, < 4.7.3-r4
• from 0, < 4.14.12-1
• from 0, < 4.9.65-3+deb9u2
• from 0, < 384.111-1
• from 0, < 4.11.1~pre+1.733450b39b-1

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-5754
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-5754