{"id":"CVE-2022-23960","title":"Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB","summary":"Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted br…","severity":"medium","cvss":5.6,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","vendor":"xen","product":"xen","affected":["xen","cortex-r7_firmware","cortex-r8_firmware","cortex-a57_firmware","cortex-a65_firmware","cortex-a65ae_firmware","cortex-a710_firmware","cortex-a72_firmware","cortex-a73_firmware","cortex-a75_firmware","cortex-a76_firmware","cortex-a76ae_firmware","cortex-a77_firmware","cortex-a78_firmware","cortex-a78ae_firmware","cortex-x1_firmware","cortex-x2_firmware","neoverse-e1_firmware","neoverse-v1_firmware","neoverse_n1_firmware","neoverse_n2_firmware","debian_linux = 9.0","debian_linux = 10.0"],"published":"2022-03-13","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:19.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-23960","references":[{"url":"http://www.openwall.com/lists/oss-security/2022/03/18/2","label":"cve@mitre.org"},{"url":"https://developer.arm.com/support/arm-security-updates","label":"cve@mitre.org"},{"url":"https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html","label":"cve@mitre.org"},{"url":"https://www.debian.org/security/2022/dsa-5173","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2022/03/18/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://developer.arm.com/support/arm-security-updates","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2022/dsa-5173","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23960.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-23960"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062284"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23960"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23960"},{"url":"https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/spectre-bhb"},{"url":"https://access.redhat.com/errata/RHSA-2024:0930"},{"url":"https://access.redhat.com/errata/RHSA-2022:7683"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00499,"epssPercentile":0.42566,"ingestedAt":"2026-10-08T23:16:47.339Z","patched":["virtualization_4_hypervisor_for_rhel 8","enterprise_linux_baseos_eus_v_8_6","enterprise_linux_baseos_v_8","codeready_linux_builder_eus_v_8_6","codeready_linux_builder_v_8"],"scores":{"nvd":5.6,"vendor":4.7},"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-08T21:12:20.862769Z"},"slug":"CVE-2022-23960","body":"## Overview\n\nCertain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.\n\n## Affected\n\n- `xen`\n- `cortex-r7_firmware`\n- `cortex-r8_firmware`\n- `cortex-a57_firmware`\n- `cortex-a65_firmware`\n- `cortex-a65ae_firmware`\n- `cortex-a710_firmware`\n- `cortex-a72_firmware`\n- `cortex-a73_firmware`\n- `cortex-a75_firmware`\n- `cortex-a76_firmware`\n- `cortex-a76ae_firmware`\n- `cortex-a77_firmware`\n- `cortex-a78_firmware`\n- `cortex-a78ae_firmware`\n- `cortex-x1_firmware`\n- `cortex-x2_firmware`\n- `neoverse-e1_firmware`\n- `neoverse-v1_firmware`\n- `neoverse_n1_firmware`\n- `neoverse_n2_firmware`\n- `debian_linux = 9.0`\n- `debian_linux = 10.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2024:0930** · Red Hat · fixed in: Red Hat Virtualization 4 Hypervisor for RHEL 8, Red Hat Enterprise Linux BaseOS EUS (v.8.6), Red Hat CodeReady Linux Builder EUS (v.8.6) · released 2024-02-21 · [advisory](https://access.redhat.com/errata/RHSA-2024:0930)\n- **RHSA-2022:7683** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2022-11-08 · [advisory](https://access.redhat.com/errata/RHSA-2022:7683)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23960.json)","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":30.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}