CVE-2023-52746

xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()

Low · published May 21, 2024

CVSS v3.1
2.5
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()

int type = nla_type(nla);

if (type > XFRMA_MAX) {

return -EOPNOTSUPP;

}

@type is then used as an array index and can be used

as a Spectre v1 gadget.

if (nla_len(nla) < compat_policy[type].len) {

array_index_nospec() can be used to prevent leaking

content of kernel memory to malicious users.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Published
2024-05-21T15:23Z
EPSS history
Timeline
  • 21 MAY 15:23Z
    xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
    cvelistv5