CVE-2023-52481
published 2024-02-29CVE-2023-52481: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the…
PriorityP423medium4.7CVSS 3.1
AVNACLPRHUINSUCLILAL
EPSS
0.60%
45.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
Implement the workaround for ARM Cortex-A520 erratum 2966298. On an
affected Cortex-A520 core, a speculatively executed unprivileged load
might leak data from a privileged load via a cache side channel. The
issue only exists for loads within a translation regime with the same
translation (e.g. same ASID and VMID). Therefore, the issue only affects
the return to EL0.
The workaround is to execute a TLBI before returning to EL0 after all
loads of privileged data. A non-shareable TLBI to any address is
sufficient.
The workaround isn't necessary if page table isolation (KPTI) is
enabled, but for simplicity it will be. Page table isolation should
normally be disabled for Cortex-A520 as it supports the CSV3 feature
and the E0PD feature (used when KASLR is enabled).
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c | 6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c |
| linux | linux | >= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 32b0a4ffcaea44a00a61e40c0d1bcc50362aee25 | 32b0a4ffcaea44a00a61e40c0d1bcc50362aee25 |
| linux | linux | >= 0be7320a635c2e434e8b67e0e9474a85ceb421c4 < 471470bc7052d28ce125901877dd10e4c048e513 | 471470bc7052d28ce125901877dd10e4c048e513 |
| linux | linux_kernel | < 6.1.57 | 6.1.57 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 6.2 < 6.5.7 | 6.5.7 |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3qpr-v3fc-q5q5: In the Linux kernel, the following vulnerability has been resolved:
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
Implemen
ghsa_unreviewed·2024-02-29
CVE-2023-52481 [MEDIUM] GHSA-3qpr-v3fc-q5q5: In the Linux kernel, the following vulnerability has been resolved:
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
Implemen
In the Linux kernel, the following vulnerability has been resolved:
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
Implement the workaround for ARM Cortex-A520 erratum 2966298. On an
affected Cortex-A520 core, a speculatively executed unprivileged load
might leak data from a privileged load via a cache side channel. The
issue only exists for loads within a translation regime with the same
translation (e.g. same ASID and VMID). Therefore, the issue only affects
the return to EL0.
The workaround is to execute a TLBI before returning to EL0 after all
loads of privileged data. A non-shareable TLBI to any address is
sufficient.
The workaround isn't necessary if page table isolation (KPTI) is
enabled, but for simplicity it will be. Page table isolation should
normall
OSV
CVE-2023-52481: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement
osv·2024-02-29·CVSS 4.7
CVE-2023-52481 [MEDIUM] CVE-2023-52481: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the workaround for ARM Cortex-A520 erratum 2966298. On an affected Cortex-A520 core, a speculatively executed unprivileged load might leak data from a privileged load via a cache side channel. The issue only exists for loads within a translation regime with the same translation (e.g. same ASID and VMID). Therefore, the issue only affects the return to EL0. The workaround is to execute a TLBI before returning to EL0 after all loads of privileged data. A non-shareable TLBI to any address is sufficient. The workaround isn't necessary if page table isolation (KPTI) is enabled, but for simplicity it will be. Page table isolation should normally be
Red Hat
kernel: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
vendor_redhat·2024-02-29·CVSS 4.7
CVE-2023-52481 [MEDIUM] CWE-1300 kernel: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
kernel: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
In the Linux kernel, the following vulnerability has been resolved:
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
Implement the workaround for ARM Cortex-A520 erratum 2966298. On an
affected Cortex-A520 core, a speculatively executed unprivileged load
might leak data from a privileged load via a cache side channel. The
issue only exists for loads within a translation regime with the same
translation (e.g. same ASID and VMID). Therefore, the issue only affects
the return to EL0.
The workaround is to execute a TLBI before returning to EL0 after all
loads of privileged data. A non-shareable TLBI to any address is
sufficient.
The workaround isn't necessary if page table isolation (KPTI) i
Microsoft
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
vendor_msrc·2024-02-13·CVSS 4.7
CVE-2023-52481 [MEDIUM] arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2023-52481: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: erra...
vendor_debian·2023·CVSS 4.7
CVE-2023-52481 [MEDIUM] CVE-2023-52481: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: erra...
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the workaround for ARM Cortex-A520 erratum 2966298. On an affected Cortex-A520 core, a speculatively executed unprivileged load might leak data from a privileged load via a cache side channel. The issue only exists for loads within a translation regime with the same translation (e.g. same ASID and VMID). Therefore, the issue only affects the return to EL0. The workaround is to execute a TLBI before returning to EL0 after all loads of privileged data. A non-shareable TLBI to any address is sufficient. The workaround isn't necessary if page table isolation (KPTI) is enabled, but for simplicity it will be. Page table isolation should normally be
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/32b0a4ffcaea44a00a61e40c0d1bcc50362aee25https://git.kernel.org/stable/c/471470bc7052d28ce125901877dd10e4c048e513https://git.kernel.org/stable/c/6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372chttps://git.kernel.org/stable/c/32b0a4ffcaea44a00a61e40c0d1bcc50362aee25https://git.kernel.org/stable/c/471470bc7052d28ce125901877dd10e4c048e513https://git.kernel.org/stable/c/6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c
2024-02-29
Published