CVE-2017-5928

low-risk
Published 2017-02-27

The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code.

Do I need to act?

-
0.64% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (1)

High Resolution Time Api

Affected Vendors

W3

References (6)

Technical Description http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
Third Party Advisory http://www.securityfocus.com/bid/97036
Third Party Advisory https://www.vusec.net/projects/anc
Technical Description http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
Third Party Advisory http://www.securityfocus.com/bid/97036
Third Party Advisory https://www.vusec.net/projects/anc
20
/ 100
low-risk
Severity 13/34 · Low
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal