Arm Neoverse-N2 sensitive information in resource not removed before reuse

Summaryinfo

A vulnerability was found in Arm Neoverse-N2, Neoverse-V3AE, Neoverse-V3, Neoverse-V2, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-A710, C1-Premium and C1-Ultra. It has been classified as problematic. This issue affects some unknown processing. This manipulation causes sensitive information in resource not removed before reuse. The identification of this vulnerability is CVE-2025-0647. The attack can only be executed locally. There is no exploit available.

Detailsinfo

A vulnerability has been found in Arm Neoverse-N2, Neoverse-V3AE, Neoverse-V3, Neoverse-V2, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-A710, C1-Premium and C1-Ultra and classified as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a sensitive information in resource not removed before reuse vulnerability. The CWE definition for the vulnerability is CWE-226. The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities. As an impact it is known to affect confidentiality. The summary by CVE is:

In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.

It is possible to read the advisory at developer.arm.com. This vulnerability is known as CVE-2025-0647 since 01/22/2025. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0122). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Google Cloud Platform

Productinfo

Vendor

• Arm

Name

• C1-Premium
• C1-Ultra
• Cortex-A710
• Cortex-X2
• Cortex-X3
• Cortex-X4
• Cortex-X925
• Neoverse-N2
• Neoverse-V2
• Neoverse-V3
• Neoverse-V3AE

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion