CVE-2024-7881
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents...
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
CVE-2024-7881- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-1422
- Updated
- 2026-11-02
EUVDEUVD-2024-48071
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
EUVD-2024-48071- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-75fm-2jm9-p338
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents...
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
GHSA-75fm-2jm9-p338- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
NVD
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
CVE-2024-7881- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-7881
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
DEBIAN-CVE-2024-7881- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1342
arm-trusted-firmware security update
Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.
Security Fix(es):
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.(CVE-2024-7881)
- Record
OESA-2025-1342- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2025-1343
arm-trusted-firmware security update
Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.
Security Fix(es):
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.(CVE-2024-7881)
- Record
OESA-2025-1343- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1344
arm-trusted-firmware security update
Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.
Security Fix(es):
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.(CVE-2024-7881)
- Record
OESA-2025-1344- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1345
arm-trusted-firmware security update
Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.
Security Fix(es):
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.(CVE-2024-7881)
- Record
OESA-2025-1345- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-7881
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
UBUNTU-CVE-2024-7881- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVASB-A-361573291 No score
In TBD of TBD, there is a possible memory leak due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
ASB-A-361573291- Updated
- 2026-11-05
OSV No score
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- Record
CVE-2024-7881- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11242-1 No score
spectre-meltdown-checker-26.36.0602723-1.1 on GA media
These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11242-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
:unknown:Android |
SoCVersion:0 up to SoCVersion:2025-09-05, plus listed versions SoCVersion |
SoCVersion:2025-09-05 |
arm-trusted-firmwareDebian:12 |
All versions, plus listed versions 2.10.0+dfsg-12.10.10+dfsg-12.12.0+dfsg-12.12.0+dfsg-22.12.1+dfsg-1 Show 5 moreShow less2.12.16+dfsg-12.8.0+dfsg-12.9.0+dfsg-12.9.0+dfsg-22.9.0+dfsg-3 |
None known |
arm-trusted-firmwareDebian:13 |
before 2.12.1+dfsg-1 | 2.12.1+dfsg-1 |
arm-trusted-firmwareDebian:14 |
before 2.12.1+dfsg-1 | 2.12.1+dfsg-1 |
arm-trusted-firmwareopenEuler:24.03-LTS |
before 2.12.1-1.oe2403 | 2.12.1-1.oe2403 |
arm-trusted-firmwareopenEuler:24.03-LTS-SP1 |
before 2.12.1-1.oe2403sp1 | 2.12.1-1.oe2403sp1 |
arm-trusted-firmwareopenEuler:22.03-LTS-SP3 |
before 2.12.1-1.oe2203sp3 | 2.12.1-1.oe2203sp3 |
arm-trusted-firmwareopenEuler:22.03-LTS-SP4 |
before 2.12.1-1.oe2203sp4 | 2.12.1-1.oe2203sp4 |
arm-trusted-firmwareUbuntu:20.04:LTS |
All versions, plus listed versions 2.1-32.2-2 |
None known |
arm-trusted-firmwareUbuntu:22.04:LTS |
All versions, plus listed versions 2.5+dfsg-12.6+dfsg-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
arm-trusted-firmwareUbuntu:24.04:LTS |
All versions, plus listed versions 2.9.0+dfsg-32.10.0+dfsg-12.10.0+dfsg-1build12.10.0+dfsg-1build2 |
None known |
arm-trusted-firmwareUbuntu:25.10 |
All versions, plus listed versions 2.10.0+dfsg-1build2 |
None known |
arm-trusted-firmwareUbuntu:26.10 |
All versions, plus listed versions 2.12.1+dfsg-12.12.1+dfsg-1ubuntu1 |
None known |
arm-trusted-firmwareUbuntu:26.04:LTS |
All versions, plus listed versions 2.10.0+dfsg-1build22.12.1+dfsg-1 |
None known |
spectre-meltdown-checkeropenSUSE:Tumbleweed From an advisory covering 28 CVEs |
before 26.36.0602723-1.1 | 26.36.0602723-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-7881 is a medium vulnerability (CVSS 5.1) in Arm C1-premium, published January 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in :unknown: SoCVersion:2025-09-05.
References
developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-7881
nvd.nist.gov/vuln/detail/CVE-2024-7881
github.com/advisories/GHSA-75fm-2jm9-p338
source.android.com/security/bulletin/2025-09-01
security-tracker.debian.org/tracker/CVE-2024-7881
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1342
Show 33 moreShow less
ubuntu.com/security/CVE-2024-7881
cve.org/CVERecord?id=CVE-2024-7881
suse.com/security/cve/CVE-2017-5715