CVE-2024-5660

Published Dec 10, 2024 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Arm

Cortex-A77

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V1

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-A78AE

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-78C

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X1C

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-A78

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X1

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse N2

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-A710

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X2

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V2

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X3

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V3AE

affected

Version	Status	Constraints
`0`	affected	—

Arm

Neoverse V3

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X4

affected

Version	Status	Constraints
`0`	affected	—

Arm

Cortex-X925

affected

Version	Status	Constraints
`0`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:arm:cortex-a710_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a710:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:arm:cortex-a77_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a77:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:arm:cortex-a78_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a78:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:arm:cortex-a78ae_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a78ae:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:arm:cortex-a78c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-a78c:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:arm:cortex-x1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x1:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:arm:cortex-x1c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x1c:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:arm:cortex-x2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x2:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:arm:cortex-x3_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x3:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:arm:cortex-x4_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x4:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:arm:cortex-x925_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:cortex-x925:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:arm:neoverse_n2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse_n2:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:arm:neoverse-v1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v1:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:arm:neoverse-v2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v2:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:arm:neoverse-v3_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v3:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:arm:neoverse-v3ae_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arm:neoverse-v3ae:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.551% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660

History

Jan 5, 2026 2:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Arm Arm cortex-a710 Arm cortex-a710 Firmware Arm cortex-a77 Arm cortex-a77 Firmware Arm cortex-a78 Arm cortex-a78 Firmware Arm cortex-a78ae Arm cortex-a78ae Firmware Arm cortex-a78c Arm cortex-a78c Firmware Arm cortex-x1 Arm cortex-x1 Firmware Arm cortex-x1c Arm cortex-x1c Firmware Arm cortex-x2 Arm cortex-x2 Firmware Arm cortex-x3 Arm cortex-x3 Firmware Arm cortex-x4 Arm cortex-x4 Firmware Arm cortex-x925 Arm cortex-x925 Firmware Arm neoverse-v1 Arm neoverse-v1 Firmware Arm neoverse-v2 Arm neoverse-v2 Firmware Arm neoverse-v3 Arm neoverse-v3 Firmware Arm neoverse-v3ae Arm neoverse-v3ae Firmware Arm neoverse N2 Arm neoverse N2 Firmware
CPEs		cpe:2.3:h:arm:cortex-a710:-:::::::* cpe:2.3:h:arm:cortex-a77:-:::::::* cpe:2.3:h:arm:cortex-a78:-:::::::* cpe:2.3:h:arm:cortex-a78ae:-:::::::* cpe:2.3:h:arm:cortex-a78c:-:::::::* cpe:2.3:h:arm:cortex-x1:-:::::::* cpe:2.3:h:arm:cortex-x1c:-:::::::* cpe:2.3:h:arm:cortex-x2:-:::::::* cpe:2.3:h:arm:cortex-x3:-:::::::* cpe:2.3:h:arm:cortex-x4:-:::::::* cpe:2.3:h:arm:cortex-x925:-:::::::* cpe:2.3:h:arm:neoverse-v1:-:::::::* cpe:2.3:h:arm:neoverse-v2:-:::::::* cpe:2.3:h:arm:neoverse-v3:-:::::::* cpe:2.3:h:arm:neoverse-v3ae:-:::::::* cpe:2.3:h:arm:neoverse_n2:-:::::::* cpe:2.3:o:arm:cortex-a710_firmware:-:::::::* cpe:2.3:o:arm:cortex-a77_firmware:-:::::::* cpe:2.3:o:arm:cortex-a78_firmware:-:::::::* cpe:2.3:o:arm:cortex-a78ae_firmware:-:::::::* cpe:2.3:o:arm:cortex-a78c_firmware:-:::::::* cpe:2.3:o:arm:cortex-x1_firmware:-:::::::* cpe:2.3:o:arm:cortex-x1c_firmware:-:::::::* cpe:2.3:o:arm:cortex-x2_firmware:-:::::::* cpe:2.3:o:arm:cortex-x3_firmware:-:::::::* cpe:2.3:o:arm:cortex-x4_firmware:-:::::::* cpe:2.3:o:arm:cortex-x925_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v1_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v2_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v3_firmware:-:::::::* cpe:2.3:o:arm:neoverse-v3ae_firmware:-:::::::* cpe:2.3:o:arm:neoverse_n2_firmware:-:::::::*
Vendors & Products		Arm Arm cortex-a710 Arm cortex-a710 Firmware Arm cortex-a77 Arm cortex-a77 Firmware Arm cortex-a78 Arm cortex-a78 Firmware Arm cortex-a78ae Arm cortex-a78ae Firmware Arm cortex-a78c Arm cortex-a78c Firmware Arm cortex-x1 Arm cortex-x1 Firmware Arm cortex-x1c Arm cortex-x1c Firmware Arm cortex-x2 Arm cortex-x2 Firmware Arm cortex-x3 Arm cortex-x3 Firmware Arm cortex-x4 Arm cortex-x4 Firmware Arm cortex-x925 Arm cortex-x925 Firmware Arm neoverse-v1 Arm neoverse-v1 Firmware Arm neoverse-v2 Arm neoverse-v2 Firmware Arm neoverse-v3 Arm neoverse-v3 Firmware Arm neoverse-v3ae Arm neoverse-v3ae Firmware Arm neoverse N2 Arm neoverse N2 Firmware

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00113}`	epss `{'score': 0.00127}`

Dec 16, 2024 1:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection	Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Dec 10, 2024 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Dec 10, 2024 3:00 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection
Weaknesses		CWE-668
References		https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660

Subscriptions

Arm Cortex-a710 Cortex-a710 Firmware Cortex-a77 Cortex-a77 Firmware Cortex-a78 Cortex-a78 Firmware Cortex-a78ae Cortex-a78ae Firmware Cortex-a78c Cortex-a78c Firmware Cortex-x1 Cortex-x1 Firmware Cortex-x1c Cortex-x1c Firmware Cortex-x2 Cortex-x2 Firmware Cortex-x3 Cortex-x3 Firmware Cortex-x4 Cortex-x4 Firmware Cortex-x925 Cortex-x925 Firmware Neoverse-v1 Neoverse-v1 Firmware Neoverse-v2 Neoverse-v2 Firmware Neoverse-v3 Neoverse-v3 Firmware Neoverse-v3ae Neoverse-v3ae Firmware Neoverse N2 Neoverse N2 Firmware

Weaknesses