CVE-2023-52996

ipv4: prevent potential spectre v1 gadget in fib_metrics_match()

published March 27, 2025

CVSS
—
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ipv4: prevent potential spectre v1 gadget in fib_metrics_match()

if (!type)

continue;

if (type > RTAX_MAX)

return false;

...

fi_val = fi->fib_metrics->metrics[type - 1];

@type being used as an array index, we need to prevent

cpu speculation or risk leaking kernel memory content.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00268 · 18.0th percentile
Published
2025-03-27T16:43Z
EPSS history
Timeline
  • 27 MAR 16:43Z
    ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
    cvelistv5