Arm Neoverse V2 / V3 / V3AE, Cortex-X3 / X4 / X925, C1-series

CVSS 5.1CVE-2024-7881Firmware, BMC & network fabricTFV-13data memory-dependent prefetch leakcurated

Impact

Unprivileged code can steer a data-memory-dependent prefetcher into loading a privileged address and then dereferencing its contents, turning the prefetcher into a read oracle for kernel, hypervisor or secure-world memory. On a shared training or inference node this is a slow but real cross-boundary leak - the kind of thing that gets you key material and pointers for a follow-on exploit rather than an instant escape. Neoverse V2 is the Grace core, so GH200 and GB200 head nodes are in scope.

Who can reach it

Any unprivileged process on the host, or unprivileged code inside a guest. No devices, no network, no physical access. A container tenant on a shared Arm node is enough.

What to do

EL3 firmware sets CPUACTLR6_EL1[41]=1 (or IMP_CPUECTLR_EL1[49]=1 on C1-Pro) to disable the offending prefetcher, and exposes it via SMCCC_ARCH_WORKAROUND_4. It is enabled by default in fixed TF-A on vulnerable cores, so the operator task is 'take the OEM firmware build and flash it', with the usual reboot and drain. Disabling a prefetcher is not free - expect single-digit percent regression on pointer-chasing workloads. There is no software-only mitigation you can apply without the firmware update.

References

https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-13.html https://nvd.nist.gov/vuln/detail/CVE-2024-7881

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.