CVE-2024-28956

Published May 13, 2025

Last updated 5 days ago

Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-28956 involves the exposure of sensitive information in shared microarchitectural structures during transient execution on some Intel processors. An authenticated local user could potentially extract sensitive information by exploiting microarchitectural weaknesses. This vulnerability affects the Linux kernel via cBPF, where direct branches may be predicted. Oracle has released security updates to address this vulnerability.

Description: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Source: secure@intel.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 5.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

CVSS 3.1

Type: Secondary
Base score: 5.6
Impact score: 4
Exploitability score: 1.1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Severity: MEDIUM

Hype score: Not currently trending

References