Vulnerability · Published Apr 25, 2023 · Assigned by Google
CVE-2023-0045Incorrect indirect branch prediction barrier in the Linux Kernel
Medium 4.7
In plain English
A medium-severity security flaw in Linux Kernel from Linux. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 6.1.7-1 | DEBIAN-CVE-2023-0045 |
| Debian:13 | linux | 6.1.7-1 | DEBIAN-CVE-2023-0045 |
| Debian:14 | linux | 6.1.7-1 | DEBIAN-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux | 5.15.0-69.76 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux | 5.15.0-69.76 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1033.37 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1033.37 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1035.42 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1035.42 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 5.19.0-1022.23~22.04.1 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1035.42.1 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1035.42.1 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1031.38 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1031.38 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1030.35 | USN-5987-1 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1030.35 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1017.22 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1017.22 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 5.19.0-38.39~22.04.1 | USN-5979-1 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 5.19.0-38.39~22.04.1 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1027.30 | USN-5987-1 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1027.30 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1027.32 | USN-6004-1 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1027.32 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1030.35 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1030.35 | USN-5987-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-69.76 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-69.76 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 5.19.0-1021.22~22.04.1 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1023.23 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1028.29 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1028.29 | USN-5913-1 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 6.0.0-1012.12 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 6.0.0-1012.12 | USN-5914-1 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1007.7 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1007.7 | USN-5915-1 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1032.38 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1032.38 | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1026.28 | USN-5982-1 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1026.28 | UBUNTU-CVE-2023-0045 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2023-0045 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2023-0045 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | 9137bb27e60e – before a664ec9158eeddd75121d39c9a0758016097fa96 |
Weakness: CWE-610 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://git.kernel.org/tip/a664ec9158eeddd75121d39c9a0758016097fa96
- https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
- https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
- https://security.netapp.com/advisory/ntap-20230714-0001/
- https://github.com/google/security-research/security/advisories/GHSA-9x5g-vmxf-4qj8