CVE-2017-5925

PoC ×2—

CVSS 3.0

7.5 high

EPSS

2%p74

Published

Feb 27, 2017 (Feb 27, 2017)

Modified

Jun 17, 2026

Description

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.

Vendors: allwinner amd intel nvidia samsung
Products: a64, athlon ii 640 x4, e-350, fx-8120 8-core, fx-8320 8-core, fx-8350 8-core, phenom 9550 4-core, atom c2750, celeron n2840, core i5 m480, core i7-2620qm, core i7-3632qm
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news2 stories

ASLR Protection could be bypassed by visiting a website.Millions of devices at risk

Security AffairsFeb 17, 11:06 UTC · Feb 17, 2017Exploit / PoC CVE-2017-5925 CVE-2017-5926 CVE-2017-5927+1 CVEs

A Simple JavaScript Exploit Bypasses ASLR Protection On 22 CPU Architectures

The Hacker NewsFeb 15, 00:00 UTC · Feb 15, 2017Vulnerability CVE-2013-0753 CVE-2017-5925 CVE-2017-5926+2 CVEs