CVE-2023-52746
published 2024-05-21CVE-2023-52746: In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type =…
PriorityP48low2.5CVSS 3.1
AVLACHPRLUINSUCLINAN
EPSS
0.24%
15.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
int type = nla_type(nla);
if (type > XFRMA_MAX) {
return -EOPNOTSUPP;
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
if (nla_len(nla) < compat_policy[type].len) {
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.12-1 (bookworm) | linux 6.1.12-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 5106f4a8acff480e244300bc5097c0ad7048c3a2 < a893cc644812728e86e9aff517fd5698812ecef0 | a893cc644812728e86e9aff517fd5698812ecef0 |
| linux | linux | >= 5106f4a8acff480e244300bc5097c0ad7048c3a2 < 5dc688fae6b7be9dbbf5304a3d2520d038e06db5 | 5dc688fae6b7be9dbbf5304a3d2520d038e06db5 |
| linux | linux | >= 5106f4a8acff480e244300bc5097c0ad7048c3a2 < 419674224390fca298020fc0751a20812f84b12d | 419674224390fca298020fc0751a20812f84b12d |
| linux | linux | >= 5106f4a8acff480e244300bc5097c0ad7048c3a2 < b6ee896385380aa621102e8ea402ba12db1cabff | b6ee896385380aa621102e8ea402ba12db1cabff |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.12-1 | 6.1.12-1 |
| linux | linux_kernel | >= 0 < 6.1.12-1 | 6.1.12-1 |
| linux | linux_kernel | >= 0 < 6.1.12-1 | 6.1.12-1 |
| linux | linux_kernel | >= 5.10 < 5.10.168 | 5.10.168 |
| linux | linux_kernel | >= 5.11 < 5.15.94 | 5.15.94 |
| linux | linux_kernel | >= 5.16 < 6.1.12 | 6.1.12 |
CVSS provenance
nvdv3.12.5LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
osv2.5LOW
vendor_debian2.5LOW
vendor_redhat2.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
vendor_redhat·2024-05-21·CVSS 2.5
CVE-2023-52746 [LOW] CWE-1300 kernel: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
kernel: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
In the Linux kernel, the following vulnerability has been resolved:
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
int type = nla_type(nla);
if (type > XFRMA_MAX) {
return -EOPNOTSUPP;
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
if (nla_len(nla) < compat_policy[type].len) {
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel
Debian
CVE-2023-52746: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm/compat...
vendor_debian·2023·CVSS 2.5
CVE-2023-52746 [LOW] CVE-2023-52746: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm/compat...
In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be used as a Spectre v1 gadget. if (nla_len(nla) < compat_policy[type].len) { array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users.
Scope: local
bookworm: resolved (fixed in 6.1.12-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.12-1)
sid: resolved (fixed in 6.1.12-1)
trixie: resolved (fixed in 6.1.12-1)
OSV
CVE-2023-52746: In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type =
osv·2024-05-21·CVSS 2.5
CVE-2023-52746 [LOW] CVE-2023-52746: In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type =
In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be used as a Spectre v1 gadget. if (nla_len(nla) < compat_policy[type].len) { array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users.
GHSA
GHSA-jg34-cmw8-gw85: In the Linux kernel, the following vulnerability has been resolved:
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
int type
ghsa_unreviewed·2024-05-21
CVE-2023-52746 [LOW] CWE-401 GHSA-jg34-cmw8-gw85: In the Linux kernel, the following vulnerability has been resolved:
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
int type
In the Linux kernel, the following vulnerability has been resolved:
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
int type = nla_type(nla);
if (type > XFRMA_MAX) {
return -EOPNOTSUPP;
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
if (nla_len(nla) < compat_policy[type].len) {
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/419674224390fca298020fc0751a20812f84b12dhttps://git.kernel.org/stable/c/5dc688fae6b7be9dbbf5304a3d2520d038e06db5https://git.kernel.org/stable/c/a893cc644812728e86e9aff517fd5698812ecef0https://git.kernel.org/stable/c/b6ee896385380aa621102e8ea402ba12db1cabffhttps://git.kernel.org/stable/c/419674224390fca298020fc0751a20812f84b12dhttps://git.kernel.org/stable/c/5dc688fae6b7be9dbbf5304a3d2520d038e06db5https://git.kernel.org/stable/c/a893cc644812728e86e9aff517fd5698812ecef0https://git.kernel.org/stable/c/b6ee896385380aa621102e8ea402ba12db1cabff
2024-05-21
Published