CVE-2017-5754

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

Published: 2018-01-04 Last update: 2026-05-28 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2017-5754 is rated Moderate Risk (57.2/100): CVSS Medium severity, with high exploitation likelihood (EPSS 89.59%, 100th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2017-5754

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-05 89.69% 89.59% -0.09%
2 2026-06-02 89.32% 89.69% +0.36%
3 2026-05-30 — 89.32% —

Full EPSS history (63 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2017-5754

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.6 3.1 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 1.1 4.0 134c704f-9b21-4f2e-91b3-4a467353bcc0
5.6 3.0 MEDIUM
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 1.1 4.0 [email protected]
4.7 2.0 MEDIUM
AV:L/AC:M/Au:N/C:C/I:N/A:N Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 3.4 6.9 [email protected]

Weakness enumeration for CVE-2017-5754

OS Trackers for CVE-2017-5754

vendor priority summary link
alpine — CVE-2017-5754: 1 source package rows (intel-ucode); 7 state rows across 7 repos (3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 7, open 0. https://security.alpinelinux.org/vuln/CVE-2017-5754
debian not yet assigned CVE-2017-5754 not yet assigned priority: Debian including 4 source packages (linux, nvidia-graphics-drivers, nvidia-graphics-drivers-legacy-340xx, xen), 16 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 16. https://security-tracker.debian.org/tracker/CVE-2017-5754
gentoo normal CVE-2017-5754: 1 GLSA(s) (201810-06), 2 atom(s) (app-emulation/xen, app-emulation/xen-tools); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2017-5754
redhat high — https://access.redhat.com/security/cve/CVE-2017-5754
suse high — https://www.suse.com/security/cve/CVE-2017-5754/
ubuntu critical CVE-2017-5754 critical priority: Ubuntu including 81 source packages (firefox, linux, …), 702 status rows across 12 suites (artful, bionic, cosmic, disco, focal, jammy, noble, oracular, trusty, upstream, xenial, zesty): DNE 453, not-affected 130, released 105, ignored 14. https://ubuntu.com/security/CVE-2017-5754

Affected software / configurations for CVE-2017-5754

Vendor Product Version Raw CPE
intel atom_c c2308 cpe:2.3:h:intel:atom_c:c2308:*:*:*:*:*:*:*
intel atom_c c2316 cpe:2.3:h:intel:atom_c:c2316:*:*:*:*:*:*:*
intel atom_c c2338 cpe:2.3:h:intel:atom_c:c2338:*:*:*:*:*:*:*
intel atom_c c2350 cpe:2.3:h:intel:atom_c:c2350:*:*:*:*:*:*:*
intel atom_c c2358 cpe:2.3:h:intel:atom_c:c2358:*:*:*:*:*:*:*
intel atom_c c2508 cpe:2.3:h:intel:atom_c:c2508:*:*:*:*:*:*:*
intel atom_c c2516 cpe:2.3:h:intel:atom_c:c2516:*:*:*:*:*:*:*
intel atom_c c2518 cpe:2.3:h:intel:atom_c:c2518:*:*:*:*:*:*:*
intel atom_c c2530 cpe:2.3:h:intel:atom_c:c2530:*:*:*:*:*:*:*
intel atom_c c2538 cpe:2.3:h:intel:atom_c:c2538:*:*:*:*:*:*:*
intel atom_c c2550 cpe:2.3:h:intel:atom_c:c2550:*:*:*:*:*:*:*
intel atom_c c2558 cpe:2.3:h:intel:atom_c:c2558:*:*:*:*:*:*:*
intel atom_c c2718 cpe:2.3:h:intel:atom_c:c2718:*:*:*:*:*:*:*
intel atom_c c2730 cpe:2.3:h:intel:atom_c:c2730:*:*:*:*:*:*:*
intel atom_c c2738 cpe:2.3:h:intel:atom_c:c2738:*:*:*:*:*:*:*
intel atom_c c2750 cpe:2.3:h:intel:atom_c:c2750:*:*:*:*:*:*:*
intel atom_c c2758 cpe:2.3:h:intel:atom_c:c2758:*:*:*:*:*:*:*
intel atom_c c3308 cpe:2.3:h:intel:atom_c:c3308:*:*:*:*:*:*:*
intel atom_c c3338 cpe:2.3:h:intel:atom_c:c3338:*:*:*:*:*:*:*
intel atom_c c3508 cpe:2.3:h:intel:atom_c:c3508:*:*:*:*:*:*:*
intel atom_c c3538 cpe:2.3:h:intel:atom_c:c3538:*:*:*:*:*:*:*
intel atom_c c3558 cpe:2.3:h:intel:atom_c:c3558:*:*:*:*:*:*:*
intel atom_c c3708 cpe:2.3:h:intel:atom_c:c3708:*:*:*:*:*:*:*
intel atom_c c3750 cpe:2.3:h:intel:atom_c:c3750:*:*:*:*:*:*:*
intel atom_c c3758 cpe:2.3:h:intel:atom_c:c3758:*:*:*:*:*:*:*
intel atom_c c3808 cpe:2.3:h:intel:atom_c:c3808:*:*:*:*:*:*:*
intel atom_c c3830 cpe:2.3:h:intel:atom_c:c3830:*:*:*:*:*:*:*
intel atom_c c3850 cpe:2.3:h:intel:atom_c:c3850:*:*:*:*:*:*:*
intel atom_c c3858 cpe:2.3:h:intel:atom_c:c3858:*:*:*:*:*:*:*
intel atom_c c3950 cpe:2.3:h:intel:atom_c:c3950:*:*:*:*:*:*:*
intel atom_c c3955 cpe:2.3:h:intel:atom_c:c3955:*:*:*:*:*:*:*
intel atom_c c3958 cpe:2.3:h:intel:atom_c:c3958:*:*:*:*:*:*:*
intel atom_e e3805 cpe:2.3:h:intel:atom_e:e3805:*:*:*:*:*:*:*
intel atom_e e3815 cpe:2.3:h:intel:atom_e:e3815:*:*:*:*:*:*:*
intel atom_e e3825 cpe:2.3:h:intel:atom_e:e3825:*:*:*:*:*:*:*
intel atom_e e3826 cpe:2.3:h:intel:atom_e:e3826:*:*:*:*:*:*:*
intel atom_e e3827 cpe:2.3:h:intel:atom_e:e3827:*:*:*:*:*:*:*
intel atom_e e3845 cpe:2.3:h:intel:atom_e:e3845:*:*:*:*:*:*:*
intel atom_x3 c3130 cpe:2.3:h:intel:atom_x3:c3130:*:*:*:*:*:*:*
intel atom_x3 c3200rk cpe:2.3:h:intel:atom_x3:c3200rk:*:*:*:*:*:*:*
intel atom_x3 c3205rk cpe:2.3:h:intel:atom_x3:c3205rk:*:*:*:*:*:*:*
intel atom_x3 c3230rk cpe:2.3:h:intel:atom_x3:c3230rk:*:*:*:*:*:*:*
intel atom_x3 c3235rk cpe:2.3:h:intel:atom_x3:c3235rk:*:*:*:*:*:*:*
intel atom_x3 c3265rk cpe:2.3:h:intel:atom_x3:c3265rk:*:*:*:*:*:*:*
intel atom_x3 c3295rk cpe:2.3:h:intel:atom_x3:c3295rk:*:*:*:*:*:*:*
intel atom_x3 c3405 cpe:2.3:h:intel:atom_x3:c3405:*:*:*:*:*:*:*
intel atom_x3 c3445 cpe:2.3:h:intel:atom_x3:c3445:*:*:*:*:*:*:*
intel atom_z z2420 cpe:2.3:h:intel:atom_z:z2420:*:*:*:*:*:*:*
intel atom_z z2460 cpe:2.3:h:intel:atom_z:z2460:*:*:*:*:*:*:*
intel atom_z z2480 cpe:2.3:h:intel:atom_z:z2480:*:*:*:*:*:*:*
intel atom_z z2520 cpe:2.3:h:intel:atom_z:z2520:*:*:*:*:*:*:*
intel atom_z z2560 cpe:2.3:h:intel:atom_z:z2560:*:*:*:*:*:*:*
intel atom_z z2580 cpe:2.3:h:intel:atom_z:z2580:*:*:*:*:*:*:*
intel atom_z z2760 cpe:2.3:h:intel:atom_z:z2760:*:*:*:*:*:*:*
intel atom_z z3460 cpe:2.3:h:intel:atom_z:z3460:*:*:*:*:*:*:*
intel atom_z z3480 cpe:2.3:h:intel:atom_z:z3480:*:*:*:*:*:*:*
intel atom_z z3530 cpe:2.3:h:intel:atom_z:z3530:*:*:*:*:*:*:*
intel atom_z z3560 cpe:2.3:h:intel:atom_z:z3560:*:*:*:*:*:*:*
intel atom_z z3570 cpe:2.3:h:intel:atom_z:z3570:*:*:*:*:*:*:*
intel atom_z z3580 cpe:2.3:h:intel:atom_z:z3580:*:*:*:*:*:*:*
intel atom_z z3590 cpe:2.3:h:intel:atom_z:z3590:*:*:*:*:*:*:*
intel atom_z z3735d cpe:2.3:h:intel:atom_z:z3735d:*:*:*:*:*:*:*
intel atom_z z3735e cpe:2.3:h:intel:atom_z:z3735e:*:*:*:*:*:*:*
intel atom_z z3735f cpe:2.3:h:intel:atom_z:z3735f:*:*:*:*:*:*:*
intel atom_z z3735g cpe:2.3:h:intel:atom_z:z3735g:*:*:*:*:*:*:*
intel atom_z z3736f cpe:2.3:h:intel:atom_z:z3736f:*:*:*:*:*:*:*
intel atom_z z3736g cpe:2.3:h:intel:atom_z:z3736g:*:*:*:*:*:*:*
intel atom_z z3740 cpe:2.3:h:intel:atom_z:z3740:*:*:*:*:*:*:*
intel atom_z z3740d cpe:2.3:h:intel:atom_z:z3740d:*:*:*:*:*:*:*
intel atom_z z3745 cpe:2.3:h:intel:atom_z:z3745:*:*:*:*:*:*:*
intel atom_z z3745d cpe:2.3:h:intel:atom_z:z3745d:*:*:*:*:*:*:*
intel atom_z z3770 cpe:2.3:h:intel:atom_z:z3770:*:*:*:*:*:*:*
intel atom_z z3770d cpe:2.3:h:intel:atom_z:z3770d:*:*:*:*:*:*:*
intel atom_z z3775 cpe:2.3:h:intel:atom_z:z3775:*:*:*:*:*:*:*
intel atom_z z3775d cpe:2.3:h:intel:atom_z:z3775d:*:*:*:*:*:*:*
intel atom_z z3785 cpe:2.3:h:intel:atom_z:z3785:*:*:*:*:*:*:*
intel atom_z z3795 cpe:2.3:h:intel:atom_z:z3795:*:*:*:*:*:*:*
intel celeron_j j1750 cpe:2.3:h:intel:celeron_j:j1750:*:*:*:*:*:*:*
intel celeron_j j1800 cpe:2.3:h:intel:celeron_j:j1800:*:*:*:*:*:*:*
intel celeron_j j1850 cpe:2.3:h:intel:celeron_j:j1850:*:*:*:*:*:*:*

References for CVE-2017-5754

URL Tags
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html
http://nvidia.custhelp.com/app/answers/detail/a_id/4609 Third Party Advisory
http://nvidia.custhelp.com/app/answers/detail/a_id/4611
http://nvidia.custhelp.com/app/answers/detail/a_id/4613
http://nvidia.custhelp.com/app/answers/detail/a_id/4614
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt
http://www.kb.cert.org/vuls/id/584653 Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/102378
http://www.securityfocus.com/bid/106128
http://www.securitytracker.com/id/1040071 Third Party Advisory VDB Entry
http://xenbits.xen.org/xsa/advisory-254.html Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0292
https://access.redhat.com/security/vulnerabilities/speculativeexecution Third Party Advisory
https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/ Third Party Advisory
https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ Third Party Advisory
https://cdrdv2.intel.com/v1/dl/getContent/685358
https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
https://cert.vde.com/en-us/advisories/vde-2018-002
https://cert.vde.com/en-us/advisories/vde-2018-003
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html
https://meltdownattack.com/ Technical Description Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002 Patch Third Party Advisory Vendor Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.asc
https://security.gentoo.org/glsa/201810-06
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html Third Party Advisory
https://security.netapp.com/advisory/ntap-20180104-0001/
https://source.android.com/security/bulletin/2018-04-01
https://support.citrix.com/article/CTX231399
https://support.citrix.com/article/CTX234679
https://support.f5.com/csp/article/K91229003 Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_us
https://support.lenovo.com/us/en/solutions/LEN-18282 Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel
https://usn.ubuntu.com/3522-3/
https://usn.ubuntu.com/3522-4/
https://usn.ubuntu.com/3523-1/
https://usn.ubuntu.com/3540-2/
https://usn.ubuntu.com/3541-2/
https://usn.ubuntu.com/3583-1/
https://usn.ubuntu.com/3597-1/
https://usn.ubuntu.com/3597-2/
https://usn.ubuntu.com/usn/usn-3516-1/
https://usn.ubuntu.com/usn/usn-3522-2/
https://usn.ubuntu.com/usn/usn-3523-2/
https://usn.ubuntu.com/usn/usn-3524-2/
https://usn.ubuntu.com/usn/usn-3525-1/
https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin
https://www.debian.org/security/2018/dsa-4078
https://www.debian.org/security/2018/dsa-4082
https://www.debian.org/security/2018/dsa-4120
https://www.kb.cert.org/vuls/id/180049
https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/ Third Party Advisory
https://www.synology.com/support/security/Synology_SA_18_01 Third Party Advisory
cvelogic Threat Intelligence