CVE-2024-5660 - Vulnerability Details

Description

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Published: 2024-12-10

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Arm

Cortex-A77

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V1

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-A78AE

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-78C

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X1C

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-A78

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X1

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse N2

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-A710

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X2

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V2

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X3

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V3AE

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V3

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X4

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X925

affected

Version	Status	Constraints
`0`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:arm:cortex-a710_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a710:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:arm:cortex-a77_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a77:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:arm:cortex-a78_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a78:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:arm:cortex-a78ae_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a78ae:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:arm:cortex-a78c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a78c:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:arm:cortex-x1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x1:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:arm:cortex-x1c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x1c:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:arm:cortex-x2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x2:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:arm:cortex-x3_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x3:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:arm:cortex-x4_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x4:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:arm:cortex-x925_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x925:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:arm:neoverse_n2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse_n2:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:arm:neoverse-v1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v1:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:arm:neoverse-v2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v2:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:arm:neoverse-v3_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v3:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:arm:neoverse-v3ae_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v3ae:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00136.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660

History

Mon, 05 Jan 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Arm Arm cortex-a710 Arm cortex-a710 Firmware Arm cortex-a77 Arm cortex-a77 Firmware Arm cortex-a78 Arm cortex-a78 Firmware Arm cortex-a78ae Arm cortex-a78ae Firmware Arm cortex-a78c Arm cortex-a78c Firmware Arm cortex-x1 Arm cortex-x1 Firmware Arm cortex-x1c Arm cortex-x1c Firmware Arm cortex-x2 Arm cortex-x2 Firmware Arm cortex-x3 Arm cortex-x3 Firmware Arm cortex-x4 Arm cortex-x4 Firmware Arm cortex-x925 Arm cortex-x925 Firmware Arm neoverse-v1 Arm neoverse-v1 Firmware Arm neoverse-v2 Arm neoverse-v2 Firmware Arm neoverse-v3 Arm neoverse-v3 Firmware Arm neoverse-v3ae Arm neoverse-v3ae Firmware Arm neoverse N2 Arm neoverse N2 Firmware
CPEs		cpe:2.3:h:arm:cortex-a710:-:::::::* cpe:2.3:h:arm:cortex-a77:-:::::::* cpe:2.3:h:arm:cortex-a78:-:::::::* cpe:2.3:h:arm:cortex-a78ae:-:::::::* cpe:2.3:h:arm:cortex-a78c:-:::::::* cpe:2.3:h:arm:cortex-x1:-:::::::* cpe:2.3:h:arm:cortex-x1c:-:::::::* cpe:2.3:h:arm:cortex-x2:-:::::::* cpe:2.3:h:arm:cortex-x3:-:::::::* cpe:2.3:h:arm:cortex-x4:-:::::::* cpe:2.3:h:arm:cortex-x925:-:::::::* cpe:2.3:h:arm:neoverse-v1:-:::::::* cpe:2.3:h:arm:neoverse-v2:-:::::::* cpe:2.3:h:arm:neoverse-v3:-:::::::* cpe:2.3:h:arm:neoverse-v3ae:-:::::::* cpe:2.3:h:arm:neoverse_n2:-:::::::* cpe:2.3:o:arm:cortex-a710_firmware:-:::::::* cpe:2.3:o:arm:cortex-a77_firmware:-:::::::* cpe:2.3:o:arm:cortex-a78_firmware:-:::::::* cpe:2.3:o:arm:cortex-a78ae_firmware:-:::::::* cpe:2.3:o:arm:cortex-a78c_firmware:-:::::::* cpe:2.3:o:arm:cortex-x1_firmware:-:::::::* cpe:2.3:o:arm:cortex-x1c_firmware:-:::::::* cpe:2.3:o:arm:cortex-x2_firmware:-:::::::* cpe:2.3:o:arm:cortex-x3_firmware:-:::::::* cpe:2.3:o:arm:cortex-x4_firmware:-:::::::* cpe:2.3:o:arm:cortex-x925_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v1_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v2_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v3_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v3ae_firmware:-:::::::* cpe:2.3:o:arm:neoverse_n2_firmware:-:::::::*
Vendors & Products		Arm Arm cortex-a710 Arm cortex-a710 Firmware Arm cortex-a77 Arm cortex-a77 Firmware Arm cortex-a78 Arm cortex-a78 Firmware Arm cortex-a78ae Arm cortex-a78ae Firmware Arm cortex-a78c Arm cortex-a78c Firmware Arm cortex-x1 Arm cortex-x1 Firmware Arm cortex-x1c Arm cortex-x1c Firmware Arm cortex-x2 Arm cortex-x2 Firmware Arm cortex-x3 Arm cortex-x3 Firmware Arm cortex-x4 Arm cortex-x4 Firmware Arm cortex-x925 Arm cortex-x925 Firmware Arm neoverse-v1 Arm neoverse-v1 Firmware Arm neoverse-v2 Arm neoverse-v2 Firmware Arm neoverse-v3 Arm neoverse-v3 Firmware Arm neoverse-v3ae Arm neoverse-v3ae Firmware Arm neoverse N2 Arm neoverse N2 Firmware

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00113}`	epss `{'score': 0.00127}`

Mon, 16 Dec 2024 13:30:00 +0000

Type	Values Removed	Values Added
Description	Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection	Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Tue, 10 Dec 2024 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 10 Dec 2024 15:00:00 +0000

Type	Values Removed	Values Added
Description		Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection
Weaknesses		CWE-668
References		https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660

Subscriptions

Arm Cortex-a710 Cortex-a710 Firmware Cortex-a77 Cortex-a77 Firmware Cortex-a78 Cortex-a78 Firmware Cortex-a78ae Cortex-a78ae Firmware Cortex-a78c Cortex-a78c Firmware Cortex-x1 Cortex-x1 Firmware Cortex-x1c Cortex-x1c Firmware Cortex-x2 Cortex-x2 Firmware Cortex-x3 Cortex-x3 Firmware Cortex-x4 Cortex-x4 Firmware Cortex-x925 Cortex-x925 Firmware Neoverse-v1 Neoverse-v1 Firmware Neoverse-v2 Neoverse-v2 Firmware Neoverse-v3 Neoverse-v3 Firmware Neoverse-v3ae Neoverse-v3ae Firmware Neoverse N2 Neoverse N2 Firmware

MITRE

Status: PUBLISHED

Assigner: Arm

Published: 2024-12-10T13:55:44.488Z

Updated: 2024-12-16T13:10:13.630Z

Reserved: 2024-06-05T16:55:44.691Z

Link: CVE-2024-5660

Vulnrichment

Updated: 2024-12-10T21:26:17.715Z

NVD

Status : Analyzed

Published: 2024-12-10T14:30:47.963

Modified: 2026-01-05T14:44:15.913

Link: CVE-2024-5660

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-668

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object