CVE-2024-45332

Published May 13, 2025

Last updated 2 months ago

Intel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-45332, also known as "Branch Privilege Injection," is a vulnerability affecting Intel CPUs. It stems from a race condition in the branch predictors, specifically the Branch Target Buffer (BTB) and Indirect Branch Predictor (IBP). These predictors, which are designed to optimize CPU performance by speculatively predicting the outcome of branch instructions, are updated asynchronously, leading to a potential security flaw. The vulnerability arises because branch predictor updates can occur during privilege switches, such as from user mode to kernel mode. This creates a window where the update is associated with the incorrect privilege level, potentially allowing a non-privileged user to access sensitive data from privileged processes. An attacker can exploit this by training the CPU to predict a specific branch target and then triggering a system call to execute code in the OS kernel, leading to the leakage of sensitive information like passwords and cryptographic keys.

Description: Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Source: secure@intel.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 5.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

CVSS 3.1

Type: Secondary
Base score: 5.6
Impact score: 4
Exploitability score: 1.1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Severity: MEDIUM

Hype score: Not currently trending

References