Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized…
Intel Corporation · Most Modern Operating Systems
The flaw is in the speculative execution and indirect branch prediction behaviour of microprocessors from Intel Corporation, and it affects most modern operating systems running on those processors. An attacker who already has local user access can perform a side-channel analysis of the data cache, which may allow unauthorized disclosure of information.
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available the same day.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
A fix was bypassed or incomplete once over 4 months.
Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- This CVECVE-2017-5754Systems with microprocessors utilizing speculative execution and…4 Jan 2018
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.
- Stated in the CVE text
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 15 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.8 May 2026
- Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos22 Mar 2026
- Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos22 Mar 2026
- clone of my pulse. this dmv kit pdfkit.net used the same off logo kit it was one of the few i found in their fcc application . rpi&macids look for9 Mar 2026
- CVE Data16 Feb 2026
- “Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)13 Feb 2026
- 9 more on OTX