CVE-2024-5660: Arm Cortex-a710 Firmware vulnerability (CVSS 9.8)

Description

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Arm Cortex-a710 Firmwareall versions

Arm Cortex-a77 Firmwareall versions

Arm Cortex-a78ae Firmwareall versions

Arm Cortex-a78c Firmwareall versions

Arm Cortex-a78 Firmwareall versions

Arm Cortex-x1c Firmwareall versions

Arm Cortex-x1 Firmwareall versions

Arm Cortex-x2 Firmwareall versions

Arm Cortex-x3 Firmwareall versions

Arm Cortex-x4 Firmwareall versions

Arm Cortex-x925 Firmwareall versions

Arm Neoverse N2 Firmwareall versions

Arm Neoverse-v1 Firmwareall versions

Arm Neoverse-v2 Firmwareall versions

Arm Neoverse-v3ae Firmwareall versions

Arm Neoverse-v3 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660

References

https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-5660 being actively exploited?

CVE-2024-5660 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.56%.

How severe is CVE-2024-5660?

CVE-2024-5660 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.56% probability of exploitation.

Which products are affected by CVE-2024-5660?

Affected products include Arm Cortex-a710 Firmware, Arm Cortex-a77 Firmware, Arm Cortex-a78ae Firmware, Arm Cortex-a78c Firmware, Arm Cortex-a78 Firmware, and 11 more.

How do I fix CVE-2024-5660?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-5660 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo