Skip to content
CVE PROGRAM SOURCE RECORD2.5 Low

CVE-2023-52746

xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() int type = nla_type(nla); if (type > XFRMA_MAX) { return -EOPNOTSUPP; } @type is then used as an array index and can be used as a Spectre v1 gadget. if (nla_len(nla) < compat_policy[type].len) { array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5106f4a8acff480e244300bc5097c0ad7048c3a2 to < a893cc644812728e86e9aff517fd5698812ecef0affected
  • 5106f4a8acff480e244300bc5097c0ad7048c3a2 to < 5dc688fae6b7be9dbbf5304a3d2520d038e06db5affected
  • 5106f4a8acff480e244300bc5097c0ad7048c3a2 to < 419674224390fca298020fc0751a20812f84b12daffected
  • 5106f4a8acff480e244300bc5097c0ad7048c3a2 to < b6ee896385380aa621102e8ea402ba12db1cabffaffected

Linux Linux

Default version status: affected

  • 5.10affected
  • 0 to < 5.10unaffected
  • 5.10.168 to ≤ 5.10.*unaffected
  • 5.15.94 to ≤ 5.15.*unaffected
  • 6.1.12 to ≤ 6.1.*unaffected
  • 6.2 to ≤ *unaffected

References