CVE-2017-5715

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

• ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

73.24% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.4% of scored records. A rank, not a probability.

NVD base score

5.6 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2018-01-04 13:00Z8 YR AGO

Last updated

2025-05-06 14:59Z1 YR AGO

Reserved

2017-02-01

Assigning CNA

intel

Record state

PUBLISHED

Severity

Medium (CVSS 5.6)

CNA CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

• CWE-203Observable DiscrepancyBase
• CWE-1037Processor Optimization Removal or Modification of Security-critical CodeBase

Data version

5.1

Document digest

0bc4621d417664dd4f25b0835a078bbf7b3942764abbe9b2215b2790ecd99dc1

• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609x_refsource_CONFIRM
• usn.ubuntu.comUSN-3560-1https://usn.ubuntu.com/3560-1/vendor-advisoryx_refsource_UBUNTU
• lists.debian.org[debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security updatehttps://lists.debian.org/debian-lts-announce/2018/07/msg00015.htmlmailing-listx_refsource_MLIST
• www.debian.orgDSA-4187https://www.debian.org/security/2018/dsa-4187vendor-advisoryx_refsource_DEBIAN
• usn.ubuntu.comUSN-3542-2https://usn.ubuntu.com/3542-2/vendor-advisoryx_refsource_UBUNTU
• security.gentoo.orgGLSA-201810-06https://security.gentoo.org/glsa/201810-06vendor-advisoryx_refsource_GENTOO
• www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlx_refsource_CONFIRM
• www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlx_refsource_CONFIRM
• usn.ubuntu.comUSN-3540-2https://usn.ubuntu.com/3540-2/vendor-advisoryx_refsource_UBUNTU
• access.redhat.comhttps://access.redhat.com/security/vulnerabilities/speculativeexecutionx_refsource_CONFIRM
• portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002x_refsource_CONFIRM
• lists.debian.org[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security updatehttps://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlmailing-listx_refsource_MLIST
• usn.ubuntu.comUSN-3597-1https://usn.ubuntu.com/3597-1/vendor-advisoryx_refsource_UBUNTU
• lists.debian.org[debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security updatehttps://lists.debian.org/debian-lts-announce/2018/07/msg00016.htmlmailing-listx_refsource_MLIST
• lists.opensuse.orgSUSE-SU-2018:0012http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgSUSE-SU-2018:0011http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlvendor-advisoryx_refsource_SUSE
• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4611x_refsource_CONFIRM
• security.googleblog.comhttps://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlx_refsource_MISC
• www.debian.orgDSA-4213https://www.debian.org/security/2018/dsa-4213vendor-advisoryx_refsource_DEBIAN
• cert.vde.comhttps://cert.vde.com/en-us/advisories/vde-2018-002x_refsource_CONFIRM
• www.debian.orgDSA-4120https://www.debian.org/security/2018/dsa-4120vendor-advisoryx_refsource_DEBIAN
• lists.opensuse.orgopenSUSE-SU-2018:0013http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00009.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-3580-1https://usn.ubuntu.com/3580-1/vendor-advisoryx_refsource_UBUNTU
• support.f5.comhttps://support.f5.com/csp/article/K91229003x_refsource_CONFIRM
• usn.ubuntu.comUSN-3531-3https://usn.ubuntu.com/3531-3/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3620-2https://usn.ubuntu.com/3620-2/vendor-advisoryx_refsource_UBUNTU
• lists.opensuse.orgopenSUSE-SU-2018:0022http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-3582-1https://usn.ubuntu.com/3582-1/vendor-advisoryx_refsource_UBUNTU
• www.debian.orgDSA-4188https://www.debian.org/security/2018/dsa-4188vendor-advisoryx_refsource_DEBIAN
• access.redhat.comRHSA-2018:0292https://access.redhat.com/errata/RHSA-2018:0292vendor-advisoryx_refsource_REDHAT
• xenbits.xen.orghttp://xenbits.xen.org/xsa/advisory-254.htmlx_refsource_CONFIRM
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20180104-0001/x_refsource_CONFIRM
• lists.opensuse.orgSUSE-SU-2018:0019http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00012.htmlvendor-advisoryx_refsource_SUSE
• www.synology.comhttps://www.synology.com/support/security/Synology_SA_18_01x_refsource_CONFIRM
• packetstormsecurity.comhttp://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.htmlx_refsource_MISC
• www.arubanetworks.comhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txtx_refsource_CONFIRM
• www.securityfocus.com102376http://www.securityfocus.com/bid/102376vdb-entryx_refsource_BID
• developer.arm.comhttps://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityx_refsource_CONFIRM
• usn.ubuntu.comUSN-3594-1https://usn.ubuntu.com/3594-1/vendor-advisoryx_refsource_UBUNTU
• www.kb.cert.orgVU#584653http://www.kb.cert.org/vuls/id/584653third-party-advisoryx_refsource_CERT-VN
• www.kb.cert.orgVU#180049https://www.kb.cert.org/vuls/id/180049third-party-advisoryx_refsource_CERT-VN
• cert.vde.comhttps://cert.vde.com/en-us/advisories/vde-2018-003x_refsource_CONFIRM
• help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixesx_refsource_CONFIRM
• lists.opensuse.orgSUSE-SU-2018:0009http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00005.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-3690-1https://usn.ubuntu.com/3690-1/vendor-advisoryx_refsource_UBUNTU
• support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_usx_refsource_CONFIRM
• www.mitel.comhttps://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001x_refsource_CONFIRM
• support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_usx_refsource_CONFIRM
• www.vmware.comhttps://www.vmware.com/us/security/advisories/VMSA-2018-0004.htmlx_refsource_CONFIRM
• usn.ubuntu.comUSN-3549-1https://usn.ubuntu.com/3549-1/vendor-advisoryx_refsource_UBUNTU
• lists.opensuse.orgSUSE-SU-2018:0007http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00003.htmlvendor-advisoryx_refsource_SUSE
• www.suse.comhttps://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/x_refsource_CONFIRM
• support.citrix.comhttps://support.citrix.com/article/CTX231399x_refsource_CONFIRM
• www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlx_refsource_CONFIRM
• spectreattack.comhttps://spectreattack.com/x_refsource_MISC
• usn.ubuntu.comUSN-3531-1https://usn.ubuntu.com/3531-1/vendor-advisoryx_refsource_UBUNTU
• security.freebsd.orgFreeBSD-SA-18:03https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.ascvendor-advisoryx_refsource_FREEBSD
• aws.amazon.comhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/x_refsource_CONFIRM
• lists.opensuse.orgSUSE-SU-2018:0006http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00002.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-3581-1https://usn.ubuntu.com/3581-1/vendor-advisoryx_refsource_UBUNTU
• blog.mozilla.orghttps://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/x_refsource_CONFIRM
• www.securitytracker.com1040071http://www.securitytracker.com/id/1040071vdb-entryx_refsource_SECTRACK
• lists.debian.org[debian-lts-announce] 20180916 [SECURITY] [DLA 1506-1] intel-microcode security updatehttps://lists.debian.org/debian-lts-announce/2018/09/msg00017.htmlmailing-listx_refsource_MLIST
• security-center.intel.comhttps://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-frx_refsource_CONFIRM
• usn.ubuntu.comUSN-3597-2https://usn.ubuntu.com/3597-2/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3581-2https://usn.ubuntu.com/3581-2/vendor-advisoryx_refsource_UBUNTU
• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4614x_refsource_CONFIRM
• lists.opensuse.orgSUSE-SU-2018:0010http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlvendor-advisoryx_refsource_SUSE
• lists.debian.org[debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security updatehttps://lists.debian.org/debian-lts-announce/2018/05/msg00000.htmlmailing-listx_refsource_MLIST
• tools.cisco.com20180104 CPU Side-Channel Information Disclosure Vulnerabilitieshttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelvendor-advisoryx_refsource_CISCO
• usn.ubuntu.comUSN-3516-1https://usn.ubuntu.com/usn/usn-3516-1/vendor-advisoryx_refsource_UBUNTU
• www.vmware.comhttps://www.vmware.com/us/security/advisories/VMSA-2018-0002.htmlx_refsource_CONFIRM
• www.exploit-db.com43427https://www.exploit-db.com/exploits/43427/exploitx_refsource_EXPLOIT-DB
• lists.opensuse.orgSUSE-SU-2018:0020http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00013.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-3541-2https://usn.ubuntu.com/3541-2/vendor-advisoryx_refsource_UBUNTU
• googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlx_refsource_MISC
• support.lenovo.comhttps://support.lenovo.com/us/en/solutions/LEN-18282x_refsource_CONFIRM
• usn.ubuntu.comUSN-3777-3https://usn.ubuntu.com/3777-3/vendor-advisoryx_refsource_UBUNTU
• lists.opensuse.orgopenSUSE-SU-2018:0023http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlvendor-advisoryx_refsource_SUSE
• www.vmware.comhttps://www.vmware.com/security/advisories/VMSA-2018-0007.htmlx_refsource_CONFIRM
• lists.opensuse.orgSUSE-SU-2018:0008http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00004.htmlvendor-advisoryx_refsource_SUSE
• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4613x_refsource_CONFIRM
• usn.ubuntu.comUSN-3561-1https://usn.ubuntu.com/3561-1/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3582-2https://usn.ubuntu.com/3582-2/vendor-advisoryx_refsource_UBUNTU
• seclists.org20190624 [SECURITY] [DSA 4469-1] libvirt security updatehttps://seclists.org/bugtraq/2019/Jun/36mailing-listx_refsource_BUGTRAQ
• www.arubanetworks.comhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txtx_refsource_CONFIRM
• www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlx_refsource_MISC
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfx_refsource_CONFIRM
• security.freebsd.orgFreeBSD-SA-19:26https://security.FreeBSD.org/advisories/FreeBSD-SA-19:26.mcu.ascvendor-advisoryx_refsource_FREEBSD
• seclists.org20191112 FreeBSD Security Advisory FreeBSD-SA-19:26.mcuhttps://seclists.org/bugtraq/2019/Nov/16mailing-listx_refsource_BUGTRAQ
• packetstormsecurity.comhttp://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.htmlx_refsource_MISC
• security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2017-5715x_refsource_CONFIRM
• lists.debian.org[debian-lts-announce] 20200320 [SECURITY] [DLA 2148-1] amd64-microcode security updatehttps://lists.debian.org/debian-lts-announce/2020/03/msg00025.htmlmailing-listx_refsource_MLIST
• lists.debian.org[debian-lts-announce] 20210816 [SECURITY] [DLA 2743-1] amd64-microcode security updatehttps://lists.debian.org/debian-lts-announce/2021/08/msg00019.htmlmailing-listx_refsource_MLIST