Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• intel atom cc2308
• intel atom cc2316
• intel atom cc2338
• intel atom cc2350
• intel atom cc2358
• intel atom cc2508
• intel atom cc2516
• intel atom cc2518
• intel atom cc2530
• intel atom cc2538
• intel atom cc2550
• intel atom cc2558
• intel atom cc2718
• intel atom cc2730
• intel atom cc2738
• intel atom cc2750
• intel atom cc2758
• intel atom cc3308
• intel atom cc3338
• intel atom cc3508

Versions reported by the vendor

Affected version ranges reported by the assigning authority (intel). Independent of NVD's CPE analysis and usually ahead of it.

• Intel Corporation Most Modern Operating Systems

  • Allaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-5753Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at
  50Plan
• CVE-2017-5715Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information
  44Plan
• CVE-2018-3639Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior mem
  40Plan
• CVE-2018-3693Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at
  25Monitor
• CVE-2018-3640Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized d
  24Monitor
• CVE-2018-9056Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.