Ampere Altra / Altra Max processors: The Arm-server variant of Hertzbleed

CVE-2022-35888Firmware, BMC & network fabricHertzbleed (Ampere Altra)curated

Impact

The Arm-server variant of Hertzbleed. Relevant because Ampere Altra is a common host CPU under GPU nodes in Arm-based AI racks and in several neocloud fleets - operators who assumed the Hertzbleed story was x86-only still have it.

Who can reach it

Authenticated user able to time operations, including over the network against host crypto.

What to do

Ampere published a security bulletin rather than a firmware fix. Mitigation is constant-time crypto and, at high cost, disabling frequency scaling. Treat as UNPATCHABLE in hardware.

References

https://amperecomputing.com/products/security-bulletins/hertzbleed.html https://nvd.nist.gov/vuln/detail/CVE-2022-35888

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.