CVE-2020-13844

Published: Jun 8, 2020Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation."

Affected (9)

Products: Arm: Cortex A32 Firmware, Cortex A35 Firmware, Cortex A53 Firmware, Cortex A57 Firmware, Cortex A72 Firmware, Cortex A73 Firmware, Cortex A34 Firmware · Opensuse: Leap

7 products

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A32 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A32	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A35 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A35	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A53 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A53	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A57 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A57	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A72 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A72	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A73 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A73	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arm Cortex A34 Firmware	All versions

Running on/with	Platform Versions
Arm Cortex A34	All versions

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Related CWEs

CWE-203

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (14)

http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00039.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00040.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability

Source: cve@mitre.org

Vendor Advisory

https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation

Source: cve@mitre.org

Vendor Advisory

https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions

Source: cve@mitre.org

Vendor Advisory

https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547520.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html