CVE-2023-52997

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

published March 27, 2025

CVSS
—
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

if (!type)

continue;

if (type > RTAX_MAX)

return -EINVAL;

...

metrics[type - 1] = val;

@type being used as an array index, we need to prevent

cpu speculation or risk leaking kernel memory content.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Published
2025-03-27T16:43Z
EPSS history
Timeline
  • 27 MAR 16:43Z
    ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
    cvelistv5