CVE-2023-53000
published 2025-03-27CVE-2023-53000: In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.20%
10.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from
__nla_validate_parse() or validate_nla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
This should take care of vast majority of netlink uses,
but an audit is needed to take care of others where
validation is not yet centralized in core netlink functions.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= bfa83a9e03cf8d501c6272999843470afecb32ed < 3e5082b1c66c7783fbcd79b5b178573230e528ff | 3e5082b1c66c7783fbcd79b5b178573230e528ff |
| linux | linux | >= bfa83a9e03cf8d501c6272999843470afecb32ed < 539ca5dcbc91134bbe2c45677811c31d8b030d2d | 539ca5dcbc91134bbe2c45677811c31d8b030d2d |
| linux | linux | >= bfa83a9e03cf8d501c6272999843470afecb32ed < 41b74e95f297ac360ca7ed6bf200100717cb6c45 | 41b74e95f297ac360ca7ed6bf200100717cb6c45 |
| linux | linux | >= bfa83a9e03cf8d501c6272999843470afecb32ed < 992e4ff7116a77968039277b5d6aaa535c2f2184 | 992e4ff7116a77968039277b5d6aaa535c2f2184 |
| linux | linux | >= bfa83a9e03cf8d501c6272999843470afecb32ed < f0950402e8c76e7dcb08563f1b4e8000fbc62455 | f0950402e8c76e7dcb08563f1b4e8000fbc62455 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 2.6.15 < 5.4.231 | 5.4.231 |
| linux | linux_kernel | >= 5.11 < 5.15.91 | 5.15.91 |
| linux | linux_kernel | >= 5.16 < 6.1.9 | 6.1.9 |
| linux | linux_kernel | >= 5.5 < 5.10.166 | 5.10.166 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: netlink: prevent potential spectre v1 gadgets
vendor_redhat·2025-03-27·CVSS 7.8
CVE-2023-53000 [HIGH] CWE-129 kernel: netlink: prevent potential spectre v1 gadgets
kernel: netlink: prevent potential spectre v1 gadgets
In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from
__nla_validate_parse() or validate_nla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
This should take care of vast majority of netlink uses,
but an audit is needed to take care of others where
validation is not yet centralized in core netlink functions.
Statement: The bug is that potentially could happen read out of bounds for the usage of variable type in
Debian
CVE-2023-53000: linux - In the Linux kernel, the following vulnerability has been resolved: netlink: pr...
vendor_debian·2023·CVSS 7.8
CVE-2023-53000 [HIGH] CVE-2023-53000: linux - In the Linux kernel, the following vulnerability has been resolved: netlink: pr...
In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
Scope: local
bookworm: resolved (fixed in 6.1.11-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.11-1)
sid: resolved (fixed in 6.1.11-1
GHSA
GHSA-jw5w-h5c8-x699: In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed
ghsa_unreviewed·2025-03-27
CVE-2023-53000 [HIGH] CWE-129 GHSA-jw5w-h5c8-x699: In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed
In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from
__nla_validate_parse() or validate_nla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
This should take care of vast majority of netlink uses,
but an audit is needed to take care of others where
validation is not yet centralized in core netlink functions.
OSV
CVE-2023-53000: In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed a
osv·2025-03-27·CVSS 7.8
CVE-2023-53000 [HIGH] CVE-2023-53000: In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed a
In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ffhttps://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2dhttps://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455
2025-03-27
Published