CVE-2023-53000

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53000
In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff Patch
https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45 Patch
https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d Patch
https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184 Patch
https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*
History

30 Oct 2025, 16:40

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netlink: evitar posibles gadgets de Spectre v1 La mayoría de los atributos de netlink se analizan y validan desde __nla_validate_parse() o validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type se usa entonces como un índice de matriz y puede usarse como un gadget de Spectre v1. array_index_nospec() puede usarse para evitar la filtración de contenido de la memoria del kernel a usuarios maliciosos. Esto debería solucionar la gran mayoría de los usos de netlink, pero se necesita una auditoría para encargarse de otros donde la validación aún no está centralizada en las funciones principales de netlink.
References () https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff - () https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff - Patch
References () https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45 - () https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45 - Patch
References () https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d - () https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d - Patch
References () https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184 - () https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184 - Patch
References () https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455 - () https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-129
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

27 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 17:15

Updated : 2025-10-30 16:40

NVD link : CVE-2023-53000

Mitre link : CVE-2023-53000

CVE.ORG link : CVE-2023-53000

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index