In the Linux kernel, the following vulnerability has been resolved:
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
int type = nla_type(nla);
if (type > XFRMA_MAX) {
return -EOPNOTSUPP;
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
if (nla_len(nla) < compat_policy[type].len) {
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
References
Configurations
Configuration 1 (hide)
|
History
02 Apr 2025, 14:50
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/419674224390fca298020fc0751a20812f84b12d - Patch | |
| References | () https://git.kernel.org/stable/c/5dc688fae6b7be9dbbf5304a3d2520d038e06db5 - Patch | |
| References | () https://git.kernel.org/stable/c/a893cc644812728e86e9aff517fd5698812ecef0 - Patch | |
| References | () https://git.kernel.org/stable/c/b6ee896385380aa621102e8ea402ba12db1cabff - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:* |
|
| CWE | CWE-401 |
Information
Published : 2024-05-21 16:15
Updated : 2025-04-02 14:50
NVD link : CVE-2023-52746
Mitre link : CVE-2023-52746
CVE.ORG link : CVE-2023-52746
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime