{"id":"CVE-2024-7881","aliases":["A-361573291","ASB-A-361573291","DEBIAN-CVE-2024-7881","EUVD-2024-48071","GHSA-75fm-2jm9-p338","OESA-2025-1342","OESA-2025-1343","OESA-2025-1344","OESA-2025-1345","UBUNTU-CVE-2024-7881","openSUSE-SU-2026:11242-1"],"status":"published","title":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents...","description":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00198,"percentile":0.09695,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1422","CWE-203"],"published":"2025-01-28T15:01:44Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":":unknown:","fixed_in":["SoCVersion:2025-09-05"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"arm-trusted-firmware","fixed_in":["2.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"arm-trusted-firmware","fixed_in":["2.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"arm-trusted-firmware","fixed_in":["2.12.1-1.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"arm-trusted-firmware","fixed_in":["2.12.1-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"arm-trusted-firmware","fixed_in":["2.12.1-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"arm-trusted-firmware","fixed_in":["2.12.1-1.oe2203sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2025-09-05"}]}],"versions":["SoCVersion"]},{"source":"osv","ecosystem":"Debian:12","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg-1","2.10.10+dfsg-1","2.12.0+dfsg-1","2.12.0+dfsg-2","2.12.1+dfsg-1","2.12.16+dfsg-1","2.8.0+dfsg-1","2.9.0+dfsg-1","2.9.0+dfsg-2","2.9.0+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-1.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1-3","2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5+dfsg-1","2.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.0+dfsg-3","2.10.0+dfsg-1","2.10.0+dfsg-1build1","2.10.0+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1+dfsg-1","2.12.1+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"arm-trusted-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg-1build2","2.12.1+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"spectre-meltdown-checker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.36.0602723-1.1"}]}],"bundled":28}],"products":[{"vendor":"arm","product":"c1-premium"},{"vendor":"arm","product":"c1-premium_firmware"},{"vendor":"arm","product":"c1-pro"},{"vendor":"arm","product":"c1-pro_firmware"},{"vendor":"arm","product":"c1-ultra"},{"vendor":"arm","product":"c1-ultra_firmware"},{"vendor":"arm","product":"cortex-x3"},{"vendor":"arm","product":"cortex-x3_firmware"},{"vendor":"arm","product":"cortex-x4"},{"vendor":"arm","product":"cortex-x4_firmware"},{"vendor":"arm","product":"cortex-x925"},{"vendor":"arm","product":"cortex-x925_firmware"},{"vendor":"arm","product":"neoverse v2"},{"vendor":"arm","product":"neoverse v3"},{"vendor":"arm","product":"neoverse v3ae"},{"vendor":"arm","product":"neoverse-v2_firmware"},{"vendor":"arm","product":"neoverse-v3_firmware"},{"vendor":"arm","product":"neoverse-v3ae_firmware"}],"references":[{"url":"https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-7881","tags":["Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7881","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-75fm-2jm9-p338"},{"url":"https://source.android.com/security/bulletin/2025-09-01","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-7881","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1342","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1343","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1344","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1345","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-7881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7881","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-20569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-20588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54505","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-7881","description":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:01:44.445Z","modified":"2025-11-18T13:14:02.578Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1422"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-48071","description":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:01:44Z","modified":"2025-11-18T13:14:02Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:15.806163Z"}],"ghsa":[{"id":"GHSA-75fm-2jm9-p338","title":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents...","description":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:31:57Z","modified":"2025-12-18T18:31:32Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:05:16.313648Z"}],"nvd":[{"id":"CVE-2024-7881","description":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:15:12.847Z","modified":"2026-06-17T08:21:06.38Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:10:43.581383Z"}],"osv":[{"id":"DEBIAN-CVE-2024-7881","description":"An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:15:12.847Z","modified":"2026-11-02T12:03:12.359796929Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"OESA-2025-1342","title":"arm-trusted-firmware security update","description":"Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\n\nAn unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.(CVE-2024-7881)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:17:50.997260648Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1343","title":"arm-trusted-firmware security update","description":"Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\n\nAn unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.(CVE-2024-7881)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:17:50.666955841Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1344","title":"arm-trusted-firmware security update","description":"Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\n\nAn unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.(CVE-2024-7881)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:18:49.912391319Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1345","title":"arm-trusted-firmware security update","description":"Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures (Armv8-A and Armv7-A), including an Exception Level 3 (EL3) Secure Monitor.\r\n\r\nSecurity Fix(es):\n\nAn unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.(CVE-2024-7881)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:17:50.897562011Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2024-7881","description":"An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:15:00Z","modified":"2026-10-17T12:56:59.787804076Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"ASB-A-361573291","description":"In TBD of TBD, there is a possible memory leak due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2025-09-01T00:00:00Z","modified":"2026-11-12T17:24:32.213657206Z","updated_at":"2026-11-10T17:35:06.383013Z"},{"id":"CVE-2024-7881","description":"An unprivileged context can trigger a data\nmemory-dependent prefetch engine to fetch the contents of a privileged location\nand consume those contents as an address that is also dereferenced.","status":"published","published":"2025-01-28T15:15:12Z","modified":"2026-07-10T10:14:39.669229247Z","updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"openSUSE-SU-2026:11242-1","title":"spectre-meltdown-checker-26.36.0602723-1.1 on GA media","description":"These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.593286162Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}